/**
 * Security Monitoring and Alerting System
 * Provides real-time security monitoring, threat detection, and incident response
 */
import { EventEmitter } from "events";
export interface SecurityEvent {
    id: string;
    timestamp: Date;
    type: "authentication" | "authorization" | "input-validation" | "data-access" | "system" | "anomaly";
    severity: "critical" | "high" | "medium" | "low";
    source: string;
    details: {
        userId?: string;
        sessionId?: string;
        ipAddress?: string;
        userAgent?: string;
        endpoint?: string;
        method?: string;
        payload?: unknown;
        error?: string;
        metadata?: Record<string, unknown>;
    };
    description: string;
    riskScore: number;
    handled: boolean;
    actions: SecurityAction[];
}
interface SecurityAction {
    id: string;
    type: "block" | "throttle" | "alert" | "log" | "investigate" | "escalate";
    timestamp: Date;
    automated: boolean;
    result: "success" | "failure" | "pending";
    details: string;
}
interface SecurityAlert {
    id: string;
    eventId: string;
    timestamp: Date;
    severity: "critical" | "high" | "medium" | "low";
    title: string;
    description: string;
    category: string;
    affectedSystems: string[];
    indicators: {
        type: string;
        value: string;
        confidence: number;
    }[];
    recommendations: string[];
    status: "new" | "investigating" | "resolved" | "false-positive";
    assignee?: string;
    resolution?: {
        timestamp: Date;
        action: string;
        details: string;
    };
}
interface ThreatIntelligence {
    id: string;
    type: "ip" | "domain" | "hash" | "pattern" | "signature";
    value: string;
    confidence: number;
    severity: "critical" | "high" | "medium" | "low";
    source: string;
    description: string;
    indicators: string[];
    lastSeen: Date;
    expiry?: Date;
}
interface SecurityMetrics {
    timestamp: Date;
    events: {
        total: number;
        byType: Record<string, number>;
        bySeverity: Record<string, number>;
    };
    threats: {
        blocked: number;
        detected: number;
        investigated: number;
    };
    alerts: {
        new: number;
        resolved: number;
        falsePositives: number;
    };
    performance: {
        responseTime: number;
        detectionRate: number;
        falsePositiveRate: number;
    };
}
/**
 * Real-time Security Monitor
 */
export declare class SecurityMonitor extends EventEmitter {
    private events;
    private alerts;
    private threatIntel;
    private anomalyPatterns;
    private metrics;
    private isMonitoring;
    private metricsInterval?;
    constructor();
    /**
     * Start security monitoring
     */
    start(): void;
    /**
     * Stop security monitoring
     */
    stop(): void;
    /**
     * Log security event
     */
    logSecurityEvent(eventData: Omit<SecurityEvent, "id" | "timestamp" | "handled" | "actions">): Promise<SecurityEvent>;
    /**
     * Process security event and take automated actions
     */
    private processSecurityEvent;
    /**
     * Create security action
     */
    private createAction;
    /**
     * Execute block action
     */
    private executeBlockAction;
    /**
     * Execute throttle action
     */
    private executeThrottleAction;
    /**
     * Execute alert action
     */
    private executeAlertAction;
    /**
     * Execute log action
     */
    private executeLogAction;
    /**
     * Create security alert
     */
    private createAlert;
    /**
     * Extract indicators from security event
     */
    private extractIndicators;
    /**
     * Generate recommendations for event
     */
    private generateRecommendations;
    /**
     * Check for suspicious activity from IP
     */
    private checkSuspiciousActivity;
    /**
     * Get failed authentication attempts for user
     */
    private getFailedAuthAttempts;
    /**
     * Check for anomalies
     */
    private checkForAnomalies;
    /**
     * Check if event matches anomaly pattern
     */
    private matchesAnomalyPattern;
    /**
     * Initialize default anomaly patterns
     */
    private initializeAnomalyPatterns;
    /**
     * Collect security metrics
     */
    private collectMetrics;
    /**
     * Group array by property
     */
    private groupBy;
    /**
     * Calculate average response time for security events
     */
    private calculateAverageResponseTime;
    /**
     * Calculate detection rate
     */
    private calculateDetectionRate;
    /**
     * Calculate false positive rate
     */
    private calculateFalsePositiveRate;
    /**
     * Add threat intelligence
     */
    addThreatIntelligence(threat: ThreatIntelligence): void;
    /**
     * Remove threat intelligence
     */
    removeThreatIntelligence(value: string): boolean;
    /**
     * Update alert status
     */
    updateAlertStatus(alertId: string, status: SecurityAlert["status"], assignee?: string): boolean;
    /**
     * Get security events
     */
    getEvents(options?: {
        limit?: number;
        offset?: number;
        severity?: string;
        type?: string;
        since?: Date;
    }): SecurityEvent[];
    /**
     * Get security alerts
     */
    getAlerts(options?: {
        limit?: number;
        offset?: number;
        severity?: string;
        status?: string;
        since?: Date;
    }): SecurityAlert[];
    /**
     * Get security metrics
     */
    getMetrics(options?: {
        since?: Date;
        until?: Date;
    }): SecurityMetrics[];
    /**
     * Get system status
     */
    getStatus(): {
        monitoring: boolean;
        eventsToday: number;
        alertsOpen: number;
        threatsBlocked: number;
        systemHealth: "healthy" | "degraded" | "critical";
    };
}
export {};
//# sourceMappingURL=SecurityMonitoring.d.ts.map