/**
 * SIEM Exporter
 *
 * Exports logs to external Security Information and Event Management systems.
 * Supports CEF, LEEF, Syslog, Splunk HEC, and JSON formats.
 *
 * Added by Pantheon Security for enterprise compliance support.
 */
import type { SIEMFormat, AlertSeverity } from "./types.js";
/**
 * SIEM event structure
 */
interface SIEMEvent {
    timestamp: string;
    event_type: string;
    event_name: string;
    severity: AlertSeverity;
    source: string;
    message: string;
    details: Record<string, unknown>;
}
/**
 * SIEM Exporter class
 */
export declare class SIEMExporter {
    private static instance;
    private config;
    private eventQueue;
    private flushTimer;
    private isExporting;
    private failedDir;
    private droppedEvents;
    private lastDropWarning;
    private constructor();
    /**
     * Get singleton instance
     */
    static getInstance(): SIEMExporter;
    /**
     * Start the flush timer
     */
    private startFlushTimer;
    /**
     * Stop the flush timer
     */
    stop(): void;
    /**
     * Check if event meets minimum severity
     */
    private meetsMinimumSeverity;
    /**
     * Check if event type is allowed
     */
    private isEventTypeAllowed;
    /**
     * Queue an event for export
     */
    queueEvent(event: SIEMEvent): Promise<boolean>;
    /**
     * Flush queued events
     */
    flush(): Promise<{
        sent: number;
        failed: number;
    }>;
    /**
     * Export a single event
     */
    private exportEvent;
    /**
     * Format event as CEF (Common Event Format)
     */
    private formatCEF;
    /**
     * Export event as CEF
     */
    private exportCEF;
    /**
     * Format event as LEEF (Log Event Extended Format)
     */
    private formatLEEF;
    /**
     * Export event as LEEF
     */
    private exportLEEF;
    /**
     * Format event as RFC 5424 syslog
     */
    private formatSyslog;
    /**
     * Export event as syslog over UDP.
     *
     * NOTE: UDP syslog is best-effort. A successful send only means the datagram
     * was handed to the OS — it does NOT confirm delivery to the collector. A
     * `settled` guard ensures the socket is closed and the promise resolves exactly
     * once (the send callback and the safety timeout previously raced, double-closing
     * and double-resolving), and the timeout is cleared as soon as the callback fires.
     */
    private exportSyslog;
    /**
     * Export event to Splunk HEC
     */
    private exportSplunkHEC;
    /**
     * Export event as JSON
     */
    private exportJSON;
    /**
     * Send message to configured endpoint
     */
    private sendToEndpoint;
    /**
     * HTTP POST request
     */
    private httpPost;
    /**
     * Escape CEF extension value
     */
    private escapeExtension;
    /**
     * Escape a LEEF key or value. LEEF is tab-delimited and newline-terminated,
     * so tabs/newlines/carriage-returns (and the `=` separator) must be neutralized
     * to prevent attribute- or record-injection into the SIEM.
     */
    private escapeLeef;
    /**
     * Escape a CEF header component (pipe-delimited). Backslash first, then pipe.
     */
    private escapeCefHeader;
    /**
     * Strip C0 control characters (CR/LF/tab/etc.) from free-text fields so a
     * crafted value cannot terminate or forge a syslog/LEEF record.
     */
    private sanitizeFreeText;
    /**
     * Save failed event for later retry
     */
    private saveFailedEvent;
    /**
     * Retry failed events
     */
    retryFailed(): Promise<{
        sent: number;
        failed: number;
    }>;
    /**
     * Get exporter statistics
     */
    getStats(): {
        enabled: boolean;
        format: SIEMFormat;
        queue_size: number;
        queue_max_size: number;
        dropped_events: number;
        endpoint_configured: boolean;
        syslog_configured: boolean;
    };
}
/**
 * Get the SIEM exporter instance
 */
export declare function getSIEMExporter(): SIEMExporter;
/**
 * Queue an event for SIEM export
 */
export declare function exportToSIEM(eventType: string, eventName: string, severity: AlertSeverity, message: string, source: string, details?: Record<string, unknown>): Promise<boolean>;
/**
 * Flush SIEM event queue
 */
export declare function flushSIEM(): Promise<{
    sent: number;
    failed: number;
}>;
export {};