/**
 * SIEM Integration Types
 *
 * Type definitions for SIEM clients and event formatting.
 *
 * @module integrations/siem/types
 */
import type { Severity } from "../../certification/types.js";
/**
 * Supported SIEM providers
 */
export type SIEMProvider = "splunk" | "sentinel" | "datadog";
/**
 * SIEM event severity mapping
 */
export type SIEMSeverity = "critical" | "high" | "medium" | "low" | "informational";
/**
 * SIEM event types
 */
export type SIEMEventType = "finding.new" | "finding.fixed" | "finding.false_positive" | "scan.started" | "scan.completed" | "scan.failed" | "certification.started" | "certification.completed" | "compliance.report" | "autofix.applied" | "autofix.pr_created";
/**
 * Base SIEM event structure
 */
export interface SIEMEvent {
    /** Event timestamp (ISO 8601) */
    timestamp: string;
    /** Event type */
    eventType: SIEMEventType;
    /** Event severity */
    severity: SIEMSeverity;
    /** Project path or identifier */
    project: string;
    /** Certification ID if applicable */
    certificationId?: string;
    /** Event message/description */
    message: string;
    /** Source of the event */
    source: "vaspera";
    /** Event-specific data */
    data: Record<string, unknown>;
}
/**
 * Finding event data
 */
export interface FindingEventData {
    findingId: string;
    severity: Severity;
    category: string;
    file?: string;
    line?: number;
    scanner?: string;
    ruleId?: string;
    cweIds?: string[];
    description?: string;
}
/**
 * Scan event data
 */
export interface ScanEventData {
    scanId?: string;
    scanners: string[];
    findingsCount: number;
    bySeverity: Record<Severity, number>;
    durationMs: number;
    error?: string;
}
/**
 * Certification event data
 */
export interface CertificationEventData {
    certificationId: string;
    level?: string;
    score?: number;
    findingsCount?: number;
    bySeverity?: Record<Severity, number>;
    durationMs?: number;
}
/**
 * SIEM connection configuration
 */
export interface SIEMConfig {
    /** Provider type */
    provider: SIEMProvider;
    /** Whether the connection is enabled */
    enabled: boolean;
    /** Connection endpoint URL */
    endpoint: string;
    /** Authentication token or API key */
    token: string;
    /** Additional provider-specific options */
    options?: Record<string, unknown>;
}
/**
 * Splunk-specific configuration
 */
export interface SplunkConfig extends SIEMConfig {
    provider: "splunk";
    options?: {
        /** Splunk index */
        index?: string;
        /** Source type */
        sourceType?: string;
        /** Source identifier */
        source?: string;
        /** Host identifier */
        host?: string;
        /** Verify TLS certificates */
        verifySsl?: boolean;
    };
}
/**
 * Microsoft Sentinel configuration
 */
export interface SentinelConfig extends SIEMConfig {
    provider: "sentinel";
    options?: {
        /** Log Analytics workspace ID */
        workspaceId: string;
        /** Custom log table name */
        logType?: string;
        /** Time generated field name */
        timeGeneratedField?: string;
    };
}
/**
 * Datadog configuration
 */
export interface DatadogConfig extends SIEMConfig {
    provider: "datadog";
    options?: {
        /** Datadog site (e.g., datadoghq.com, datadoghq.eu) */
        site?: string;
        /** Service name */
        service?: string;
        /** Environment tag */
        env?: string;
        /** Additional tags */
        tags?: string[];
    };
}
/**
 * SIEM client interface
 */
export interface SIEMClient {
    /** Provider name */
    readonly provider: SIEMProvider;
    /** Test connection to SIEM */
    testConnection(): Promise<SIEMTestResult>;
    /** Send a single event */
    sendEvent(event: SIEMEvent): Promise<SIEMSendResult>;
    /** Send multiple events in batch */
    sendEvents(events: SIEMEvent[]): Promise<SIEMBatchResult>;
    /** Close connection and cleanup */
    close(): Promise<void>;
}
/**
 * Connection test result
 */
export interface SIEMTestResult {
    success: boolean;
    provider: SIEMProvider;
    endpoint: string;
    latencyMs?: number;
    error?: string;
    details?: Record<string, unknown>;
}
/**
 * Single event send result
 */
export interface SIEMSendResult {
    success: boolean;
    eventId?: string;
    timestamp: string;
    error?: string;
}
/**
 * Batch send result
 */
export interface SIEMBatchResult {
    success: boolean;
    totalEvents: number;
    successCount: number;
    failureCount: number;
    errors?: Array<{
        index: number;
        error: string;
    }>;
}
/**
 * CEF (Common Event Format) field mapping
 */
export interface CEFFields {
    /** CEF version (always 0) */
    version: 0;
    /** Device vendor */
    deviceVendor: string;
    /** Device product */
    deviceProduct: string;
    /** Device version */
    deviceVersion: string;
    /** Signature ID (event type) */
    signatureId: string;
    /** Event name */
    name: string;
    /** Severity (0-10) */
    severity: number;
    /** Extension fields */
    extension: Record<string, string | number>;
}
//# sourceMappingURL=types.d.ts.map