/**
 * SIEM Event Formatting
 *
 * Converts Vaspera events to SIEM-compatible formats (CEF, JSON).
 *
 * @module integrations/siem/format
 */
import type { Severity } from "../../certification/types.js";
import type { SIEMEvent, SIEMSeverity, FindingEventData, ScanEventData, CertificationEventData } from "./types.js";
/**
 * Map Vaspera severity to SIEM severity
 */
export declare function mapSeverity(severity: Severity): SIEMSeverity;
/**
 * Map SIEM severity to CEF numeric severity (0-10)
 */
export declare function severityToCEF(severity: SIEMSeverity): number;
/**
 * Format event as CEF string
 */
export declare function formatAsCEF(event: SIEMEvent): string;
/**
 * Format event as JSON for generic SIEM ingestion
 */
export declare function formatAsJSON(event: SIEMEvent): object;
/**
 * Format event for Splunk HEC
 */
export declare function formatForSplunk(event: SIEMEvent, options?: {
    index?: string;
    source?: string;
    sourceType?: string;
    host?: string;
}): object;
/**
 * Format event for Microsoft Sentinel (Log Analytics)
 */
export declare function formatForSentinel(event: SIEMEvent): object;
/**
 * Format event for Datadog
 */
export declare function formatForDatadog(event: SIEMEvent, options?: {
    service?: string;
    env?: string;
    tags?: string[];
}): object;
/**
 * Create a finding event
 */
export declare function createFindingEvent(project: string, eventType: "finding.new" | "finding.fixed" | "finding.false_positive", finding: FindingEventData, certificationId?: string): SIEMEvent;
/**
 * Create a scan event
 */
export declare function createScanEvent(project: string, eventType: "scan.started" | "scan.completed" | "scan.failed", scan: ScanEventData, certificationId?: string): SIEMEvent;
/**
 * Create a certification event
 */
export declare function createCertificationEvent(project: string, eventType: "certification.started" | "certification.completed", certification: CertificationEventData): SIEMEvent;
//# sourceMappingURL=format.d.ts.map