@vorionsys/platform-core 0.1.0

package/dist/security/anomaly/types.d.ts

@@ -0,0 +1,1209 @@
+/**
+ * Anomaly Detection Types
+ *
+ * Type definitions for the rule-based anomaly detection engine.
+ * Provides interfaces for detecting suspicious patterns including:
+ * - Impossible travel (geographic anomalies)
+ * - Unusual access times (temporal anomalies)
+ * - Volume spikes (behavioral anomalies)
+ * - New device access
+ * - Authentication failure spikes
+ * - Privilege probing attempts
+ *
+ * @packageDocumentation
+ * @module security/anomaly/types
+ */
+import { z } from 'zod';
+/**
+ * Types of anomalies that can be detected
+ */
+export declare const AnomalyType: {
+    readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
+    readonly UNUSUAL_TIME: "unusual-time";
+    readonly VOLUME_SPIKE: "volume-spike";
+    readonly NEW_DEVICE: "new-device";
+    readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
+    readonly PRIVILEGE_PROBE: "privilege-probe";
+};
+export type AnomalyType = (typeof AnomalyType)[keyof typeof AnomalyType];
+export declare const anomalyTypeSchema: z.ZodNativeEnum<{
+    readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
+    readonly UNUSUAL_TIME: "unusual-time";
+    readonly VOLUME_SPIKE: "volume-spike";
+    readonly NEW_DEVICE: "new-device";
+    readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
+    readonly PRIVILEGE_PROBE: "privilege-probe";
+}>;
+/**
+ * Severity levels for detected anomalies
+ */
+export declare const AnomalySeverity: {
+    readonly LOW: "low";
+    readonly MEDIUM: "medium";
+    readonly HIGH: "high";
+    readonly CRITICAL: "critical";
+};
+export type AnomalySeverity = (typeof AnomalySeverity)[keyof typeof AnomalySeverity];
+export declare const anomalySeveritySchema: z.ZodNativeEnum<{
+    readonly LOW: "low";
+    readonly MEDIUM: "medium";
+    readonly HIGH: "high";
+    readonly CRITICAL: "critical";
+}>;
+/**
+ * An indicator of compromise or suspicious activity
+ */
+export interface Indicator {
+    /** Type of indicator */
+    type: string;
+    /** Human-readable description */
+    description: string;
+    /** Raw value of the indicator */
+    value: string | number | boolean;
+    /** Weight/importance of this indicator (0-100) */
+    weight: number;
+}
+export declare const indicatorSchema: z.ZodObject<{
+    type: z.ZodString;
+    description: z.ZodString;
+    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+    weight: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    value?: string | number | boolean;
+    description?: string;
+    type?: string;
+    weight?: number;
+}, {
+    value?: string | number | boolean;
+    description?: string;
+    type?: string;
+    weight?: number;
+}>;
+/**
+ * A detected anomaly
+ */
+export interface Anomaly {
+    /** Unique anomaly ID */
+    id: string;
+    /** When the anomaly was detected */
+    timestamp: Date;
+    /** Type of anomaly */
+    type: AnomalyType;
+    /** Severity level */
+    severity: AnomalySeverity;
+    /** Confidence score (0-100) */
+    confidence: number;
+    /** User ID if associated with a user */
+    userId?: string;
+    /** Tenant ID if multi-tenant */
+    tenantId?: string;
+    /** IP address if relevant */
+    ipAddress?: string;
+    /** Human-readable description */
+    description: string;
+    /** List of indicators that contributed to detection */
+    indicators: Indicator[];
+    /** Suggested actions to take */
+    suggestedActions: string[];
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+export declare const anomalySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    type: z.ZodNativeEnum<{
+        readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
+        readonly UNUSUAL_TIME: "unusual-time";
+        readonly VOLUME_SPIKE: "volume-spike";
+        readonly NEW_DEVICE: "new-device";
+        readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
+        readonly PRIVILEGE_PROBE: "privilege-probe";
+    }>;
+    severity: z.ZodNativeEnum<{
+        readonly LOW: "low";
+        readonly MEDIUM: "medium";
+        readonly HIGH: "high";
+        readonly CRITICAL: "critical";
+    }>;
+    confidence: z.ZodNumber;
+    userId: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+    description: z.ZodString;
+    indicators: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        description: z.ZodString;
+        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+        weight: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }, {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }>, "many">;
+    suggestedActions: z.ZodArray<z.ZodString, "many">;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    description?: string;
+    type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+    metadata?: Record<string, unknown>;
+    tenantId?: string;
+    userId?: string;
+    severity?: "critical" | "low" | "medium" | "high";
+    ipAddress?: string;
+    timestamp?: Date;
+    confidence?: number;
+    suggestedActions?: string[];
+    indicators?: {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }[];
+}, {
+    id?: string;
+    description?: string;
+    type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+    metadata?: Record<string, unknown>;
+    tenantId?: string;
+    userId?: string;
+    severity?: "critical" | "low" | "medium" | "high";
+    ipAddress?: string;
+    timestamp?: Date;
+    confidence?: number;
+    suggestedActions?: string[];
+    indicators?: {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }[];
+}>;
+/**
+ * Configuration for the anomaly detector
+ */
+export interface AnomalyDetectorConfig {
+    /** Whether anomaly detection is enabled */
+    enabled: boolean;
+    /** List of enabled detector names */
+    detectors: string[];
+    /** Minimum confidence threshold for alerting (0-100) */
+    alertThreshold: number;
+    /** Number of days to learn normal behavior patterns */
+    learningPeriodDays: number;
+    /** Whether to automatically block suspicious IPs/users */
+    autoBlock: boolean;
+    /** Confidence threshold for automatic blocking (0-100) */
+    autoBlockThreshold: number;
+    /** Redis key prefix for storage */
+    redisKeyPrefix?: string;
+}
+export declare const anomalyDetectorConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    detectors: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    alertThreshold: z.ZodDefault<z.ZodNumber>;
+    learningPeriodDays: z.ZodDefault<z.ZodNumber>;
+    autoBlock: z.ZodDefault<z.ZodBoolean>;
+    autoBlockThreshold: z.ZodDefault<z.ZodNumber>;
+    redisKeyPrefix: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    redisKeyPrefix?: string;
+    detectors?: string[];
+    alertThreshold?: number;
+    learningPeriodDays?: number;
+    autoBlock?: boolean;
+    autoBlockThreshold?: number;
+}, {
+    enabled?: boolean;
+    redisKeyPrefix?: string;
+    detectors?: string[];
+    alertThreshold?: number;
+    learningPeriodDays?: number;
+    autoBlock?: boolean;
+    autoBlockThreshold?: number;
+}>;
+/**
+ * Default configuration values
+ */
+export declare const DEFAULT_ANOMALY_DETECTOR_CONFIG: AnomalyDetectorConfig;
+/**
+ * Geographic location data
+ */
+export interface GeoLocation {
+    /** Latitude in decimal degrees */
+    latitude: number;
+    /** Longitude in decimal degrees */
+    longitude: number;
+    /** Country code (ISO 3166-1 alpha-2) */
+    countryCode?: string;
+    /** City name */
+    city?: string;
+    /** Region/state */
+    region?: string;
+    /** Timezone */
+    timezone?: string;
+}
+export declare const geoLocationSchema: z.ZodObject<{
+    latitude: z.ZodNumber;
+    longitude: z.ZodNumber;
+    countryCode: z.ZodOptional<z.ZodString>;
+    city: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    region?: string;
+    city?: string;
+    latitude?: number;
+    longitude?: number;
+    timezone?: string;
+    countryCode?: string;
+}, {
+    region?: string;
+    city?: string;
+    latitude?: number;
+    longitude?: number;
+    timezone?: string;
+    countryCode?: string;
+}>;
+/**
+ * Configuration for geographic anomaly detection
+ */
+export interface GeographicDetectorConfig {
+    /** Maximum travel speed in km/h before flagging as impossible */
+    maxTravelSpeedKmh: number;
+    /** Minimum distance in km to consider for travel analysis */
+    minDistanceKm: number;
+    /** List of country codes to flag as high risk */
+    highRiskCountries: string[];
+    /** Whether to flag VPN/proxy usage */
+    flagVpnUsage: boolean;
+}
+export declare const geographicDetectorConfigSchema: z.ZodObject<{
+    maxTravelSpeedKmh: z.ZodDefault<z.ZodNumber>;
+    minDistanceKm: z.ZodDefault<z.ZodNumber>;
+    highRiskCountries: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    flagVpnUsage: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    maxTravelSpeedKmh?: number;
+    minDistanceKm?: number;
+    highRiskCountries?: string[];
+    flagVpnUsage?: boolean;
+}, {
+    maxTravelSpeedKmh?: number;
+    minDistanceKm?: number;
+    highRiskCountries?: string[];
+    flagVpnUsage?: boolean;
+}>;
+export declare const DEFAULT_GEOGRAPHIC_DETECTOR_CONFIG: GeographicDetectorConfig;
+/**
+ * Configuration for temporal anomaly detection
+ */
+export interface TemporalDetectorConfig {
+    /** Hours of the day considered normal for access (0-23) */
+    normalHoursStart: number;
+    /** End of normal hours (0-23) */
+    normalHoursEnd: number;
+    /** Days of the week considered normal (0=Sunday, 6=Saturday) */
+    normalDays: number[];
+    /** Whether to learn user-specific patterns */
+    learnUserPatterns: boolean;
+    /** Minimum number of events to establish a baseline */
+    minEventsForBaseline: number;
+}
+export declare const temporalDetectorConfigSchema: z.ZodObject<{
+    normalHoursStart: z.ZodDefault<z.ZodNumber>;
+    normalHoursEnd: z.ZodDefault<z.ZodNumber>;
+    normalDays: z.ZodDefault<z.ZodArray<z.ZodNumber, "many">>;
+    learnUserPatterns: z.ZodDefault<z.ZodBoolean>;
+    minEventsForBaseline: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    normalHoursStart?: number;
+    normalHoursEnd?: number;
+    normalDays?: number[];
+    learnUserPatterns?: boolean;
+    minEventsForBaseline?: number;
+}, {
+    normalHoursStart?: number;
+    normalHoursEnd?: number;
+    normalDays?: number[];
+    learnUserPatterns?: boolean;
+    minEventsForBaseline?: number;
+}>;
+export declare const DEFAULT_TEMPORAL_DETECTOR_CONFIG: TemporalDetectorConfig;
+/**
+ * User access pattern for temporal analysis
+ */
+export interface UserAccessPattern {
+    /** User ID */
+    userId: string;
+    /** Histogram of access hours (24 bins) */
+    hourHistogram: number[];
+    /** Histogram of access days (7 bins) */
+    dayHistogram: number[];
+    /** Total number of events tracked */
+    totalEvents: number;
+    /** When the pattern was last updated */
+    lastUpdated: Date;
+}
+export declare const userAccessPatternSchema: z.ZodObject<{
+    userId: z.ZodString;
+    hourHistogram: z.ZodArray<z.ZodNumber, "many">;
+    dayHistogram: z.ZodArray<z.ZodNumber, "many">;
+    totalEvents: z.ZodNumber;
+    lastUpdated: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    userId?: string;
+    hourHistogram?: number[];
+    dayHistogram?: number[];
+    totalEvents?: number;
+    lastUpdated?: Date;
+}, {
+    userId?: string;
+    hourHistogram?: number[];
+    dayHistogram?: number[];
+    totalEvents?: number;
+    lastUpdated?: Date;
+}>;
+/**
+ * Configuration for volume spike detection
+ */
+export interface VolumeDetectorConfig {
+    /** Time window in minutes for rate calculation */
+    windowMinutes: number;
+    /** Standard deviations above mean to trigger alert */
+    spikeThresholdStdDev: number;
+    /** Absolute maximum requests per window before alert */
+    absoluteMaxRequests: number;
+    /** Whether to track per-user volumes */
+    trackPerUser: boolean;
+    /** Whether to track per-IP volumes */
+    trackPerIp: boolean;
+    /** Whether to track per-endpoint volumes */
+    trackPerEndpoint: boolean;
+}
+export declare const volumeDetectorConfigSchema: z.ZodObject<{
+    windowMinutes: z.ZodDefault<z.ZodNumber>;
+    spikeThresholdStdDev: z.ZodDefault<z.ZodNumber>;
+    absoluteMaxRequests: z.ZodDefault<z.ZodNumber>;
+    trackPerUser: z.ZodDefault<z.ZodBoolean>;
+    trackPerIp: z.ZodDefault<z.ZodBoolean>;
+    trackPerEndpoint: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    windowMinutes?: number;
+    spikeThresholdStdDev?: number;
+    absoluteMaxRequests?: number;
+    trackPerUser?: boolean;
+    trackPerIp?: boolean;
+    trackPerEndpoint?: boolean;
+}, {
+    windowMinutes?: number;
+    spikeThresholdStdDev?: number;
+    absoluteMaxRequests?: number;
+    trackPerUser?: boolean;
+    trackPerIp?: boolean;
+    trackPerEndpoint?: boolean;
+}>;
+export declare const DEFAULT_VOLUME_DETECTOR_CONFIG: VolumeDetectorConfig;
+/**
+ * Volume baseline statistics
+ */
+export interface VolumeBaseline {
+    /** Identifier (user ID, IP, or endpoint) */
+    identifier: string;
+    /** Type of identifier */
+    identifierType: 'user' | 'ip' | 'endpoint';
+    /** Mean requests per window */
+    mean: number;
+    /** Standard deviation */
+    stdDev: number;
+    /** Number of samples in baseline */
+    sampleCount: number;
+    /** When the baseline was last updated */
+    lastUpdated: Date;
+}
+export declare const volumeBaselineSchema: z.ZodObject<{
+    identifier: z.ZodString;
+    identifierType: z.ZodEnum<["user", "ip", "endpoint"]>;
+    mean: z.ZodNumber;
+    stdDev: z.ZodNumber;
+    sampleCount: z.ZodNumber;
+    lastUpdated: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    identifier?: string;
+    lastUpdated?: Date;
+    identifierType?: "user" | "ip" | "endpoint";
+    mean?: number;
+    stdDev?: number;
+    sampleCount?: number;
+}, {
+    identifier?: string;
+    lastUpdated?: Date;
+    identifierType?: "user" | "ip" | "endpoint";
+    mean?: number;
+    stdDev?: number;
+    sampleCount?: number;
+}>;
+/**
+ * A security event to be analyzed for anomalies
+ */
+export interface SecurityEvent {
+    /** Unique event ID */
+    eventId: string;
+    /** Event timestamp */
+    timestamp: Date;
+    /** Event type (e.g., 'login', 'api_call', 'permission_check') */
+    eventType: string;
+    /** User ID if authenticated */
+    userId?: string;
+    /** Tenant ID if multi-tenant */
+    tenantId?: string;
+    /** IP address of the request */
+    ipAddress: string;
+    /** User agent string */
+    userAgent?: string;
+    /** Geographic location if available */
+    location?: GeoLocation;
+    /** Requested resource/endpoint */
+    resource?: string;
+    /** HTTP method if applicable */
+    method?: string;
+    /** Whether the request was successful */
+    success: boolean;
+    /** Failure reason if unsuccessful */
+    failureReason?: string;
+    /** Device fingerprint if available */
+    deviceFingerprint?: string;
+    /** Additional event metadata */
+    metadata?: Record<string, unknown>;
+}
+export declare const securityEventSchema: z.ZodObject<{
+    eventId: z.ZodString;
+    timestamp: z.ZodDate;
+    eventType: z.ZodString;
+    userId: z.ZodOptional<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodString;
+    userAgent: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodObject<{
+        latitude: z.ZodNumber;
+        longitude: z.ZodNumber;
+        countryCode: z.ZodOptional<z.ZodString>;
+        city: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        timezone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        region?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    }, {
+        region?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    }>>;
+    resource: z.ZodOptional<z.ZodString>;
+    method: z.ZodOptional<z.ZodString>;
+    success: z.ZodBoolean;
+    failureReason: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    metadata?: Record<string, unknown>;
+    userAgent?: string;
+    tenantId?: string;
+    location?: {
+        region?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    };
+    success?: boolean;
+    userId?: string;
+    method?: string;
+    failureReason?: string;
+    eventType?: string;
+    ipAddress?: string;
+    timestamp?: Date;
+    resource?: string;
+    eventId?: string;
+    deviceFingerprint?: string;
+}, {
+    metadata?: Record<string, unknown>;
+    userAgent?: string;
+    tenantId?: string;
+    location?: {
+        region?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    };
+    success?: boolean;
+    userId?: string;
+    method?: string;
+    failureReason?: string;
+    eventType?: string;
+    ipAddress?: string;
+    timestamp?: Date;
+    resource?: string;
+    eventId?: string;
+    deviceFingerprint?: string;
+}>;
+/**
+ * Result from a single detector
+ */
+export interface DetectionResult {
+    /** Name of the detector */
+    detectorName: string;
+    /** Whether an anomaly was detected */
+    anomalyDetected: boolean;
+    /** Confidence score if anomaly detected (0-100) */
+    confidence?: number;
+    /** Severity if anomaly detected */
+    severity?: AnomalySeverity;
+    /** Description of the finding */
+    description?: string;
+    /** Indicators found */
+    indicators: Indicator[];
+    /** Suggested actions */
+    suggestedActions: string[];
+    /** Time taken for detection in milliseconds */
+    durationMs: number;
+    /** Error if detection failed */
+    error?: string;
+}
+export declare const detectionResultSchema: z.ZodObject<{
+    detectorName: z.ZodString;
+    anomalyDetected: z.ZodBoolean;
+    confidence: z.ZodOptional<z.ZodNumber>;
+    severity: z.ZodOptional<z.ZodNativeEnum<{
+        readonly LOW: "low";
+        readonly MEDIUM: "medium";
+        readonly HIGH: "high";
+        readonly CRITICAL: "critical";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+    indicators: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        description: z.ZodString;
+        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+        weight: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }, {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }>, "many">;
+    suggestedActions: z.ZodArray<z.ZodString, "many">;
+    durationMs: z.ZodNumber;
+    error: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    error?: string;
+    durationMs?: number;
+    description?: string;
+    severity?: "critical" | "low" | "medium" | "high";
+    confidence?: number;
+    suggestedActions?: string[];
+    indicators?: {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }[];
+    detectorName?: string;
+    anomalyDetected?: boolean;
+}, {
+    error?: string;
+    durationMs?: number;
+    description?: string;
+    severity?: "critical" | "low" | "medium" | "high";
+    confidence?: number;
+    suggestedActions?: string[];
+    indicators?: {
+        value?: string | number | boolean;
+        description?: string;
+        type?: string;
+        weight?: number;
+    }[];
+    detectorName?: string;
+    anomalyDetected?: boolean;
+}>;
+/**
+ * Aggregated result from all detectors
+ */
+export interface AggregatedDetectionResult {
+    /** The event that was analyzed */
+    event: SecurityEvent;
+    /** Results from individual detectors */
+    detectorResults: DetectionResult[];
+    /** Combined anomalies (if any) */
+    anomalies: Anomaly[];
+    /** Total processing time in milliseconds */
+    totalDurationMs: number;
+    /** Timestamp of analysis */
+    analyzedAt: Date;
+}
+export declare const aggregatedDetectionResultSchema: z.ZodObject<{
+    event: z.ZodObject<{
+        eventId: z.ZodString;
+        timestamp: z.ZodDate;
+        eventType: z.ZodString;
+        userId: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        ipAddress: z.ZodString;
+        userAgent: z.ZodOptional<z.ZodString>;
+        location: z.ZodOptional<z.ZodObject<{
+            latitude: z.ZodNumber;
+            longitude: z.ZodNumber;
+            countryCode: z.ZodOptional<z.ZodString>;
+            city: z.ZodOptional<z.ZodString>;
+            region: z.ZodOptional<z.ZodString>;
+            timezone: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        }, {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        }>>;
+        resource: z.ZodOptional<z.ZodString>;
+        method: z.ZodOptional<z.ZodString>;
+        success: z.ZodBoolean;
+        failureReason: z.ZodOptional<z.ZodString>;
+        deviceFingerprint: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        tenantId?: string;
+        location?: {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        };
+        success?: boolean;
+        userId?: string;
+        method?: string;
+        failureReason?: string;
+        eventType?: string;
+        ipAddress?: string;
+        timestamp?: Date;
+        resource?: string;
+        eventId?: string;
+        deviceFingerprint?: string;
+    }, {
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        tenantId?: string;
+        location?: {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        };
+        success?: boolean;
+        userId?: string;
+        method?: string;
+        failureReason?: string;
+        eventType?: string;
+        ipAddress?: string;
+        timestamp?: Date;
+        resource?: string;
+        eventId?: string;
+        deviceFingerprint?: string;
+    }>;
+    detectorResults: z.ZodArray<z.ZodObject<{
+        detectorName: z.ZodString;
+        anomalyDetected: z.ZodBoolean;
+        confidence: z.ZodOptional<z.ZodNumber>;
+        severity: z.ZodOptional<z.ZodNativeEnum<{
+            readonly LOW: "low";
+            readonly MEDIUM: "medium";
+            readonly HIGH: "high";
+            readonly CRITICAL: "critical";
+        }>>;
+        description: z.ZodOptional<z.ZodString>;
+        indicators: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            description: z.ZodString;
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            weight: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }>, "many">;
+        suggestedActions: z.ZodArray<z.ZodString, "many">;
+        durationMs: z.ZodNumber;
+        error: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        error?: string;
+        durationMs?: number;
+        description?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+        detectorName?: string;
+        anomalyDetected?: boolean;
+    }, {
+        error?: string;
+        durationMs?: number;
+        description?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+        detectorName?: string;
+        anomalyDetected?: boolean;
+    }>, "many">;
+    anomalies: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodDate;
+        type: z.ZodNativeEnum<{
+            readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
+            readonly UNUSUAL_TIME: "unusual-time";
+            readonly VOLUME_SPIKE: "volume-spike";
+            readonly NEW_DEVICE: "new-device";
+            readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
+            readonly PRIVILEGE_PROBE: "privilege-probe";
+        }>;
+        severity: z.ZodNativeEnum<{
+            readonly LOW: "low";
+            readonly MEDIUM: "medium";
+            readonly HIGH: "high";
+            readonly CRITICAL: "critical";
+        }>;
+        confidence: z.ZodNumber;
+        userId: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        ipAddress: z.ZodOptional<z.ZodString>;
+        description: z.ZodString;
+        indicators: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            description: z.ZodString;
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            weight: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }>, "many">;
+        suggestedActions: z.ZodArray<z.ZodString, "many">;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }, {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }>, "many">;
+    totalDurationMs: z.ZodNumber;
+    analyzedAt: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    totalDurationMs?: number;
+    event?: {
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        tenantId?: string;
+        location?: {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        };
+        success?: boolean;
+        userId?: string;
+        method?: string;
+        failureReason?: string;
+        eventType?: string;
+        ipAddress?: string;
+        timestamp?: Date;
+        resource?: string;
+        eventId?: string;
+        deviceFingerprint?: string;
+    };
+    detectorResults?: {
+        error?: string;
+        durationMs?: number;
+        description?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+        detectorName?: string;
+        anomalyDetected?: boolean;
+    }[];
+    anomalies?: {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }[];
+    analyzedAt?: Date;
+}, {
+    totalDurationMs?: number;
+    event?: {
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        tenantId?: string;
+        location?: {
+            region?: string;
+            city?: string;
+            latitude?: number;
+            longitude?: number;
+            timezone?: string;
+            countryCode?: string;
+        };
+        success?: boolean;
+        userId?: string;
+        method?: string;
+        failureReason?: string;
+        eventType?: string;
+        ipAddress?: string;
+        timestamp?: Date;
+        resource?: string;
+        eventId?: string;
+        deviceFingerprint?: string;
+    };
+    detectorResults?: {
+        error?: string;
+        durationMs?: number;
+        description?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+        detectorName?: string;
+        anomalyDetected?: boolean;
+    }[];
+    anomalies?: {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }[];
+    analyzedAt?: Date;
+}>;
+/**
+ * Interface that all detectors must implement
+ */
+export interface Detector {
+    /** Unique name of the detector */
+    readonly name: string;
+    /** Human-readable description */
+    readonly description: string;
+    /**
+     * Analyze an event for anomalies
+     * @param event The security event to analyze
+     * @returns Detection result
+     */
+    detect(event: SecurityEvent): Promise<DetectionResult>;
+    /**
+     * Update baselines with new event data
+     * @param event The event to learn from
+     */
+    learn(event: SecurityEvent): Promise<void>;
+    /**
+     * Reset all learned baselines
+     */
+    reset(): Promise<void>;
+}
+/**
+ * An alert generated from detected anomalies
+ */
+export interface AnomalyAlert {
+    /** Unique alert ID */
+    alertId: string;
+    /** The anomaly that triggered the alert */
+    anomaly: Anomaly;
+    /** Alert status */
+    status: 'open' | 'acknowledged' | 'resolved' | 'dismissed';
+    /** When the alert was created */
+    createdAt: Date;
+    /** When the alert was last updated */
+    updatedAt: Date;
+    /** User who acknowledged/resolved the alert */
+    handledBy?: string;
+    /** Notes added during handling */
+    notes?: string;
+    /** Whether automatic action was taken */
+    autoActionTaken: boolean;
+    /** Description of automatic action if taken */
+    autoActionDescription?: string;
+}
+export declare const anomalyAlertSchema: z.ZodObject<{
+    alertId: z.ZodString;
+    anomaly: z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodDate;
+        type: z.ZodNativeEnum<{
+            readonly IMPOSSIBLE_TRAVEL: "impossible-travel";
+            readonly UNUSUAL_TIME: "unusual-time";
+            readonly VOLUME_SPIKE: "volume-spike";
+            readonly NEW_DEVICE: "new-device";
+            readonly FAILED_AUTH_SPIKE: "failed-auth-spike";
+            readonly PRIVILEGE_PROBE: "privilege-probe";
+        }>;
+        severity: z.ZodNativeEnum<{
+            readonly LOW: "low";
+            readonly MEDIUM: "medium";
+            readonly HIGH: "high";
+            readonly CRITICAL: "critical";
+        }>;
+        confidence: z.ZodNumber;
+        userId: z.ZodOptional<z.ZodString>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        ipAddress: z.ZodOptional<z.ZodString>;
+        description: z.ZodString;
+        indicators: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            description: z.ZodString;
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+            weight: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }, {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }>, "many">;
+        suggestedActions: z.ZodArray<z.ZodString, "many">;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }, {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    }>;
+    status: z.ZodEnum<["open", "acknowledged", "resolved", "dismissed"]>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+    handledBy: z.ZodOptional<z.ZodString>;
+    notes: z.ZodOptional<z.ZodString>;
+    autoActionTaken: z.ZodBoolean;
+    autoActionDescription: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    status?: "acknowledged" | "open" | "resolved" | "dismissed";
+    createdAt?: Date;
+    updatedAt?: Date;
+    notes?: string;
+    alertId?: string;
+    anomaly?: {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    };
+    handledBy?: string;
+    autoActionTaken?: boolean;
+    autoActionDescription?: string;
+}, {
+    status?: "acknowledged" | "open" | "resolved" | "dismissed";
+    createdAt?: Date;
+    updatedAt?: Date;
+    notes?: string;
+    alertId?: string;
+    anomaly?: {
+        id?: string;
+        description?: string;
+        type?: "impossible-travel" | "unusual-time" | "volume-spike" | "new-device" | "failed-auth-spike" | "privilege-probe";
+        metadata?: Record<string, unknown>;
+        tenantId?: string;
+        userId?: string;
+        severity?: "critical" | "low" | "medium" | "high";
+        ipAddress?: string;
+        timestamp?: Date;
+        confidence?: number;
+        suggestedActions?: string[];
+        indicators?: {
+            value?: string | number | boolean;
+            description?: string;
+            type?: string;
+            weight?: number;
+        }[];
+    };
+    handledBy?: string;
+    autoActionTaken?: boolean;
+    autoActionDescription?: string;
+}>;
+/**
+ * Callback function for when an anomaly is detected
+ */
+export type AnomalyCallback = (anomaly: Anomaly) => void | Promise<void>;
+/**
+ * Callback function for when an alert should be generated
+ */
+export type AlertCallback = (alert: AnomalyAlert) => void | Promise<void>;
+//# sourceMappingURL=types.d.ts.map