/**
 * Correlation engine (v4.2) — CORE FEATURE.
 *
 * Aggregates individual findings into incident-level clusters.
 * Links related findings, boosts confidence, generates attack narratives,
 * and reduces noise by grouping related indicators.
 */
import type { Finding, IncidentCluster } from "./types.js";
export interface CorrelationResult {
    /** Grouped incident clusters */
    incidents: IncidentCluster[];
    /** Risk score boost from correlations (0-30) */
    riskBoost: number;
    /** Human-readable insights */
    insights: string[];
}
/**
 * Correlate findings into incident clusters.
 */
export declare function correlateFindings(findings: Finding[]): CorrelationResult;
//# sourceMappingURL=correlation-engine.d.ts.map