import { type AnyAgentTool } from "../common.js";
/**
 * CISPAR ML Score — sends a log event to the FastAPI ML microservice for
 * anomaly scoring via IsolationForest (ONNX) + River HalfSpaceTrees + Drain3.
 */
export declare const cisparMlScoreTool: AnyAgentTool;
/**
 * CISPAR Sigma Check — evaluates a structured event against Sigma rules
 * loaded in the ML microservice (ml/sigma/rules/).
 */
export declare const cisparSigmaCheckTool: AnyAgentTool;
/**
 * CISPAR Threat Intel — queries AlienVault OTX + MalwareBazaar for IOC enrichment.
 * Complements cispar_enrich_ioc with threat-feed-specific data.
 */
export declare const cisparThreatIntelTool: AnyAgentTool;
/**
 * CISPAR Train Baseline — pushes normal-behavior samples to the ML service
 * to update the online HalfSpaceTrees model and rebuild the Drain3 template miner.
 */
export declare const cisparTrainBaselineTool: AnyAgentTool;