@vorionsys/platform-core 0.1.0

package/dist/security/siem/types.d.ts

@@ -0,0 +1,1980 @@
+/**
+ * SIEM Connector Types
+ *
+ * Type definitions for the SIEM (Security Information and Event Management)
+ * connector framework including:
+ * - Security event structures
+ * - Connector configurations
+ * - Event formats (CEF, JSON, Syslog)
+ * - Enrichment options
+ *
+ * @packageDocumentation
+ * @module security/siem/types
+ */
+import { z } from 'zod';
+/**
+ * Event severity levels (aligned with CEF standard)
+ */
+export declare const EventSeverity: {
+    readonly UNKNOWN: 0;
+    readonly LOW: 1;
+    readonly MEDIUM: 4;
+    readonly HIGH: 7;
+    readonly CRITICAL: 10;
+};
+export type EventSeverity = (typeof EventSeverity)[keyof typeof EventSeverity];
+export declare const eventSeveritySchema: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<4>, z.ZodLiteral<7>, z.ZodLiteral<10>]>;
+/**
+ * Event categories
+ */
+export declare const EventCategory: {
+    readonly AUTHENTICATION: "authentication";
+    readonly AUTHORIZATION: "authorization";
+    readonly NETWORK: "network";
+    readonly APPLICATION: "application";
+    readonly SYSTEM: "system";
+    readonly MALWARE: "malware";
+    readonly DATA: "data";
+    readonly POLICY: "policy";
+    readonly ANOMALY: "anomaly";
+    readonly AUDIT: "audit";
+};
+export type EventCategory = (typeof EventCategory)[keyof typeof EventCategory];
+export declare const eventCategorySchema: z.ZodNativeEnum<{
+    readonly AUTHENTICATION: "authentication";
+    readonly AUTHORIZATION: "authorization";
+    readonly NETWORK: "network";
+    readonly APPLICATION: "application";
+    readonly SYSTEM: "system";
+    readonly MALWARE: "malware";
+    readonly DATA: "data";
+    readonly POLICY: "policy";
+    readonly ANOMALY: "anomaly";
+    readonly AUDIT: "audit";
+}>;
+/**
+ * Event action outcome
+ */
+export declare const EventOutcome: {
+    readonly SUCCESS: "success";
+    readonly FAILURE: "failure";
+    readonly UNKNOWN: "unknown";
+};
+export type EventOutcome = (typeof EventOutcome)[keyof typeof EventOutcome];
+export declare const eventOutcomeSchema: z.ZodNativeEnum<{
+    readonly SUCCESS: "success";
+    readonly FAILURE: "failure";
+    readonly UNKNOWN: "unknown";
+}>;
+/**
+ * Geographic location data for events
+ */
+export interface GeoLocation {
+    /** Country name */
+    country?: string;
+    /** Country ISO code */
+    countryCode?: string;
+    /** City name */
+    city?: string;
+    /** Region/state */
+    region?: string;
+    /** Latitude */
+    latitude?: number;
+    /** Longitude */
+    longitude?: number;
+    /** Timezone */
+    timezone?: string;
+}
+export declare const geoLocationSchema: z.ZodObject<{
+    country: z.ZodOptional<z.ZodString>;
+    countryCode: z.ZodOptional<z.ZodString>;
+    city: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    latitude: z.ZodOptional<z.ZodNumber>;
+    longitude: z.ZodOptional<z.ZodNumber>;
+    timezone: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    region?: string;
+    country?: string;
+    city?: string;
+    latitude?: number;
+    longitude?: number;
+    timezone?: string;
+    countryCode?: string;
+}, {
+    region?: string;
+    country?: string;
+    city?: string;
+    latitude?: number;
+    longitude?: number;
+    timezone?: string;
+    countryCode?: string;
+}>;
+/**
+ * Threat intelligence context
+ */
+export interface ThreatContext {
+    /** Known threat indicator */
+    indicator?: string;
+    /** Threat type (e.g., malware, botnet, spam) */
+    threatType?: string;
+    /** Confidence score (0-100) */
+    confidence?: number;
+    /** Threat feed source */
+    source?: string;
+    /** First seen timestamp */
+    firstSeen?: Date;
+    /** Last seen timestamp */
+    lastSeen?: Date;
+    /** Associated malware families */
+    malwareFamilies?: string[];
+    /** Associated threat actors */
+    threatActors?: string[];
+    /** MITRE ATT&CK techniques */
+    mitreAttack?: string[];
+}
+export declare const threatContextSchema: z.ZodObject<{
+    indicator: z.ZodOptional<z.ZodString>;
+    threatType: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodNumber>;
+    source: z.ZodOptional<z.ZodString>;
+    firstSeen: z.ZodOptional<z.ZodDate>;
+    lastSeen: z.ZodOptional<z.ZodDate>;
+    malwareFamilies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    threatActors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    mitreAttack: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    source?: string;
+    confidence?: number;
+    indicator?: string;
+    threatType?: string;
+    firstSeen?: Date;
+    lastSeen?: Date;
+    malwareFamilies?: string[];
+    threatActors?: string[];
+    mitreAttack?: string[];
+}, {
+    source?: string;
+    confidence?: number;
+    indicator?: string;
+    threatType?: string;
+    firstSeen?: Date;
+    lastSeen?: Date;
+    malwareFamilies?: string[];
+    threatActors?: string[];
+    mitreAttack?: string[];
+}>;
+/**
+ * User context for events
+ */
+export interface UserContext {
+    /** User ID */
+    userId?: string;
+    /** Username */
+    username?: string;
+    /** User email */
+    email?: string;
+    /** User roles */
+    roles?: string[];
+    /** User groups */
+    groups?: string[];
+    /** Tenant/organization ID */
+    tenantId?: string;
+    /** Tenant/organization name */
+    tenantName?: string;
+    /** Department */
+    department?: string;
+    /** Whether user is privileged */
+    privileged?: boolean;
+}
+export declare const userContextSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    tenantId: z.ZodOptional<z.ZodString>;
+    tenantName: z.ZodOptional<z.ZodString>;
+    department: z.ZodOptional<z.ZodString>;
+    privileged: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    email?: string;
+    tenantId?: string;
+    roles?: string[];
+    userId?: string;
+    privileged?: boolean;
+    username?: string;
+    groups?: string[];
+    department?: string;
+    tenantName?: string;
+}, {
+    email?: string;
+    tenantId?: string;
+    roles?: string[];
+    userId?: string;
+    privileged?: boolean;
+    username?: string;
+    groups?: string[];
+    department?: string;
+    tenantName?: string;
+}>;
+/**
+ * A security event to be sent to SIEM
+ */
+export interface SecurityEvent {
+    /** Unique event ID */
+    id: string;
+    /** Event timestamp */
+    timestamp: Date;
+    /** Event type/name */
+    eventType: string;
+    /** Event category */
+    category: EventCategory;
+    /** Event severity (0-10) */
+    severity: EventSeverity;
+    /** Action outcome */
+    outcome: EventOutcome;
+    /** Human-readable message */
+    message: string;
+    /** Detailed description */
+    description?: string;
+    /** Source IP address */
+    sourceIp?: string;
+    /** Source port */
+    sourcePort?: number;
+    /** Source hostname */
+    sourceHost?: string;
+    /** Source MAC address */
+    sourceMac?: string;
+    /** Destination IP address */
+    destinationIp?: string;
+    /** Destination port */
+    destinationPort?: number;
+    /** Destination hostname */
+    destinationHost?: string;
+    /** Destination MAC address */
+    destinationMac?: string;
+    /** Network protocol */
+    protocol?: string;
+    /** HTTP method */
+    httpMethod?: string;
+    /** HTTP URL */
+    httpUrl?: string;
+    /** HTTP status code */
+    httpStatusCode?: number;
+    /** User agent */
+    userAgent?: string;
+    /** Request ID */
+    requestId?: string;
+    /** Process name */
+    processName?: string;
+    /** Process ID */
+    processId?: number;
+    /** File path */
+    filePath?: string;
+    /** File hash */
+    fileHash?: string;
+    /** User context */
+    user?: UserContext;
+    /** Geographic location */
+    geo?: GeoLocation;
+    /** Threat intelligence context */
+    threat?: ThreatContext;
+    /** Source application/service name */
+    source: string;
+    /** Source component */
+    component?: string;
+    /** Source version */
+    version?: string;
+    /** Environment (production, staging, etc.) */
+    environment?: string;
+    /** Event tags */
+    tags?: string[];
+    /** Custom fields */
+    customFields?: Record<string, unknown>;
+    /** Raw event data for detailed analysis */
+    rawData?: Record<string, unknown>;
+}
+export declare const securityEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    eventType: z.ZodString;
+    category: z.ZodNativeEnum<{
+        readonly AUTHENTICATION: "authentication";
+        readonly AUTHORIZATION: "authorization";
+        readonly NETWORK: "network";
+        readonly APPLICATION: "application";
+        readonly SYSTEM: "system";
+        readonly MALWARE: "malware";
+        readonly DATA: "data";
+        readonly POLICY: "policy";
+        readonly ANOMALY: "anomaly";
+        readonly AUDIT: "audit";
+    }>;
+    severity: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<4>, z.ZodLiteral<7>, z.ZodLiteral<10>]>;
+    outcome: z.ZodNativeEnum<{
+        readonly SUCCESS: "success";
+        readonly FAILURE: "failure";
+        readonly UNKNOWN: "unknown";
+    }>;
+    message: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    sourceIp: z.ZodOptional<z.ZodString>;
+    sourcePort: z.ZodOptional<z.ZodNumber>;
+    sourceHost: z.ZodOptional<z.ZodString>;
+    sourceMac: z.ZodOptional<z.ZodString>;
+    destinationIp: z.ZodOptional<z.ZodString>;
+    destinationPort: z.ZodOptional<z.ZodNumber>;
+    destinationHost: z.ZodOptional<z.ZodString>;
+    destinationMac: z.ZodOptional<z.ZodString>;
+    protocol: z.ZodOptional<z.ZodString>;
+    httpMethod: z.ZodOptional<z.ZodString>;
+    httpUrl: z.ZodOptional<z.ZodString>;
+    httpStatusCode: z.ZodOptional<z.ZodNumber>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    processName: z.ZodOptional<z.ZodString>;
+    processId: z.ZodOptional<z.ZodNumber>;
+    filePath: z.ZodOptional<z.ZodString>;
+    fileHash: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        roles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        groups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        tenantId: z.ZodOptional<z.ZodString>;
+        tenantName: z.ZodOptional<z.ZodString>;
+        department: z.ZodOptional<z.ZodString>;
+        privileged: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        email?: string;
+        tenantId?: string;
+        roles?: string[];
+        userId?: string;
+        privileged?: boolean;
+        username?: string;
+        groups?: string[];
+        department?: string;
+        tenantName?: string;
+    }, {
+        email?: string;
+        tenantId?: string;
+        roles?: string[];
+        userId?: string;
+        privileged?: boolean;
+        username?: string;
+        groups?: string[];
+        department?: string;
+        tenantName?: string;
+    }>>;
+    geo: z.ZodOptional<z.ZodObject<{
+        country: z.ZodOptional<z.ZodString>;
+        countryCode: z.ZodOptional<z.ZodString>;
+        city: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodString>;
+        latitude: z.ZodOptional<z.ZodNumber>;
+        longitude: z.ZodOptional<z.ZodNumber>;
+        timezone: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        region?: string;
+        country?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    }, {
+        region?: string;
+        country?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    }>>;
+    threat: z.ZodOptional<z.ZodObject<{
+        indicator: z.ZodOptional<z.ZodString>;
+        threatType: z.ZodOptional<z.ZodString>;
+        confidence: z.ZodOptional<z.ZodNumber>;
+        source: z.ZodOptional<z.ZodString>;
+        firstSeen: z.ZodOptional<z.ZodDate>;
+        lastSeen: z.ZodOptional<z.ZodDate>;
+        malwareFamilies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        threatActors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        mitreAttack: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        source?: string;
+        confidence?: number;
+        indicator?: string;
+        threatType?: string;
+        firstSeen?: Date;
+        lastSeen?: Date;
+        malwareFamilies?: string[];
+        threatActors?: string[];
+        mitreAttack?: string[];
+    }, {
+        source?: string;
+        confidence?: number;
+        indicator?: string;
+        threatType?: string;
+        firstSeen?: Date;
+        lastSeen?: Date;
+        malwareFamilies?: string[];
+        threatActors?: string[];
+        mitreAttack?: string[];
+    }>>;
+    source: z.ZodString;
+    component: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    customFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    rawData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        roles?: string[];
+        userId?: string;
+        privileged?: boolean;
+        username?: string;
+        groups?: string[];
+        department?: string;
+        tenantName?: string;
+    };
+    version?: string;
+    component?: string;
+    id?: string;
+    description?: string;
+    message?: string;
+    environment?: string;
+    userAgent?: string;
+    requestId?: string;
+    outcome?: "unknown" | "success" | "failure";
+    source?: string;
+    eventType?: string;
+    severity?: 0 | 1 | 4 | 7 | 10;
+    tags?: string[];
+    timestamp?: Date;
+    category?: "system" | "authorization" | "audit" | "policy" | "data" | "authentication" | "network" | "anomaly" | "malware" | "application";
+    protocol?: string;
+    sourceIp?: string;
+    customFields?: Record<string, unknown>;
+    processId?: number;
+    threat?: {
+        source?: string;
+        confidence?: number;
+        indicator?: string;
+        threatType?: string;
+        firstSeen?: Date;
+        lastSeen?: Date;
+        malwareFamilies?: string[];
+        threatActors?: string[];
+        mitreAttack?: string[];
+    };
+    sourcePort?: number;
+    sourceHost?: string;
+    sourceMac?: string;
+    destinationIp?: string;
+    destinationPort?: number;
+    destinationHost?: string;
+    destinationMac?: string;
+    httpMethod?: string;
+    httpUrl?: string;
+    httpStatusCode?: number;
+    processName?: string;
+    filePath?: string;
+    fileHash?: string;
+    geo?: {
+        region?: string;
+        country?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    };
+    rawData?: Record<string, unknown>;
+}, {
+    user?: {
+        email?: string;
+        tenantId?: string;
+        roles?: string[];
+        userId?: string;
+        privileged?: boolean;
+        username?: string;
+        groups?: string[];
+        department?: string;
+        tenantName?: string;
+    };
+    version?: string;
+    component?: string;
+    id?: string;
+    description?: string;
+    message?: string;
+    environment?: string;
+    userAgent?: string;
+    requestId?: string;
+    outcome?: "unknown" | "success" | "failure";
+    source?: string;
+    eventType?: string;
+    severity?: 0 | 1 | 4 | 7 | 10;
+    tags?: string[];
+    timestamp?: Date;
+    category?: "system" | "authorization" | "audit" | "policy" | "data" | "authentication" | "network" | "anomaly" | "malware" | "application";
+    protocol?: string;
+    sourceIp?: string;
+    customFields?: Record<string, unknown>;
+    processId?: number;
+    threat?: {
+        source?: string;
+        confidence?: number;
+        indicator?: string;
+        threatType?: string;
+        firstSeen?: Date;
+        lastSeen?: Date;
+        malwareFamilies?: string[];
+        threatActors?: string[];
+        mitreAttack?: string[];
+    };
+    sourcePort?: number;
+    sourceHost?: string;
+    sourceMac?: string;
+    destinationIp?: string;
+    destinationPort?: number;
+    destinationHost?: string;
+    destinationMac?: string;
+    httpMethod?: string;
+    httpUrl?: string;
+    httpStatusCode?: number;
+    processName?: string;
+    filePath?: string;
+    fileHash?: string;
+    geo?: {
+        region?: string;
+        country?: string;
+        city?: string;
+        latitude?: number;
+        longitude?: number;
+        timezone?: string;
+        countryCode?: string;
+    };
+    rawData?: Record<string, unknown>;
+}>;
+/**
+ * Result of sending events to a SIEM connector
+ */
+export interface SendResult {
+    /** Whether the send was successful */
+    success: boolean;
+    /** Number of events sent */
+    eventsSent: number;
+    /** Number of events that failed */
+    eventsFailed: number;
+    /** Error message if failed */
+    error?: string;
+    /** Time taken in milliseconds */
+    durationMs: number;
+    /** Response from the SIEM system */
+    response?: unknown;
+    /** IDs of failed events */
+    failedEventIds?: string[];
+}
+export declare const sendResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    eventsSent: z.ZodNumber;
+    eventsFailed: z.ZodNumber;
+    error: z.ZodOptional<z.ZodString>;
+    durationMs: z.ZodNumber;
+    response: z.ZodOptional<z.ZodUnknown>;
+    failedEventIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    error?: string;
+    durationMs?: number;
+    success?: boolean;
+    response?: unknown;
+    eventsSent?: number;
+    eventsFailed?: number;
+    failedEventIds?: string[];
+}, {
+    error?: string;
+    durationMs?: number;
+    success?: boolean;
+    response?: unknown;
+    eventsSent?: number;
+    eventsFailed?: number;
+    failedEventIds?: string[];
+}>;
+/**
+ * Base connector configuration
+ */
+export interface BaseConnectorConfig {
+    /** Connector name */
+    name: string;
+    /** Whether connector is enabled */
+    enabled: boolean;
+    /** Request timeout in ms */
+    timeout?: number;
+    /** Maximum retry attempts */
+    maxRetries?: number;
+    /** Base delay for exponential backoff in ms */
+    retryDelayMs?: number;
+    /** Maximum backoff delay in ms */
+    maxRetryDelayMs?: number;
+    /** Batch size for bulk operations */
+    batchSize?: number;
+}
+export declare const baseConnectorConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    name?: string;
+    enabled?: boolean;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+}, {
+    timeout?: number;
+    name?: string;
+    enabled?: boolean;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+}>;
+/**
+ * Splunk HEC connector configuration
+ */
+export interface SplunkConnectorConfig extends BaseConnectorConfig {
+    type: 'splunk';
+    /** Splunk HEC URL */
+    hecUrl: string;
+    /** HEC token */
+    token: string;
+    /** Default index */
+    index?: string;
+    /** Default sourcetype */
+    sourcetype?: string;
+    /** Default source */
+    source?: string;
+    /** Default host */
+    host?: string;
+    /** Whether to verify SSL */
+    verifySsl?: boolean;
+    /** Custom fields to add to all events */
+    defaultFields?: Record<string, string>;
+}
+export declare const splunkConnectorConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"splunk">;
+    hecUrl: z.ZodString;
+    token: z.ZodString;
+    index: z.ZodOptional<z.ZodString>;
+    sourcetype: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+    host: z.ZodOptional<z.ZodString>;
+    verifySsl: z.ZodDefault<z.ZodBoolean>;
+    defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    token?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "splunk";
+    host?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    index?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    sourcetype?: string;
+    hecUrl?: string;
+    verifySsl?: boolean;
+    defaultFields?: Record<string, string>;
+}, {
+    timeout?: number;
+    token?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "splunk";
+    host?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    index?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    sourcetype?: string;
+    hecUrl?: string;
+    verifySsl?: boolean;
+    defaultFields?: Record<string, string>;
+}>;
+/**
+ * Elasticsearch connector configuration
+ */
+export interface ElasticConnectorConfig extends BaseConnectorConfig {
+    type: 'elastic';
+    /** Elasticsearch node URLs */
+    nodes: string[];
+    /** Authentication type */
+    auth: 'apiKey' | 'basic' | 'bearer' | 'none';
+    /** API key (for apiKey auth) */
+    apiKey?: string;
+    /** Username (for basic auth) */
+    username?: string;
+    /** Password (for basic auth) */
+    password?: string;
+    /** Bearer token (for bearer auth) */
+    bearerToken?: string;
+    /** Cloud ID (for Elastic Cloud) */
+    cloudId?: string;
+    /** Index name or pattern */
+    index: string;
+    /** Pipeline name */
+    pipeline?: string;
+    /** Whether to verify SSL */
+    verifySsl?: boolean;
+    /** Refresh policy */
+    refresh?: 'true' | 'false' | 'wait_for';
+    /** Custom CA certificate */
+    caCert?: string;
+}
+export declare const elasticConnectorConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"elastic">;
+    nodes: z.ZodArray<z.ZodString, "many">;
+    auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    bearerToken: z.ZodOptional<z.ZodString>;
+    cloudId: z.ZodOptional<z.ZodString>;
+    index: z.ZodString;
+    pipeline: z.ZodOptional<z.ZodString>;
+    verifySsl: z.ZodDefault<z.ZodBoolean>;
+    refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
+    caCert: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    password?: string;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "elastic";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    index?: string;
+    refresh?: "true" | "false" | "wait_for";
+    pipeline?: string;
+    batchSize?: number;
+    auth?: "apiKey" | "none" | "basic" | "bearer";
+    username?: string;
+    maxRetryDelayMs?: number;
+    nodes?: string[];
+    caCert?: string;
+    verifySsl?: boolean;
+    bearerToken?: string;
+    cloudId?: string;
+}, {
+    timeout?: number;
+    password?: string;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "elastic";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    index?: string;
+    refresh?: "true" | "false" | "wait_for";
+    pipeline?: string;
+    batchSize?: number;
+    auth?: "apiKey" | "none" | "basic" | "bearer";
+    username?: string;
+    maxRetryDelayMs?: number;
+    nodes?: string[];
+    caCert?: string;
+    verifySsl?: boolean;
+    bearerToken?: string;
+    cloudId?: string;
+}>;
+/**
+ * Datadog connector configuration
+ */
+export interface DatadogConnectorConfig extends BaseConnectorConfig {
+    type: 'datadog';
+    /** Datadog site (us1, us3, us5, eu1, ap1) */
+    site: 'us1' | 'us3' | 'us5' | 'eu1' | 'ap1';
+    /** API key */
+    apiKey: string;
+    /** Service name */
+    service: string;
+    /** Source */
+    source?: string;
+    /** Hostname */
+    hostname?: string;
+    /** Default tags */
+    tags?: string[];
+    /** Whether to compress payloads */
+    compress?: boolean;
+}
+export declare const datadogConnectorConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"datadog">;
+    site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
+    apiKey: z.ZodString;
+    service: z.ZodString;
+    source: z.ZodOptional<z.ZodString>;
+    hostname: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    compress: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    service?: string;
+    timeout?: number;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "datadog";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    tags?: string[];
+    hostname?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+    compress?: boolean;
+}, {
+    service?: string;
+    timeout?: number;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "datadog";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    tags?: string[];
+    hostname?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+    compress?: boolean;
+}>;
+/**
+ * Union type for all connector configurations
+ */
+export type ConnectorConfig = SplunkConnectorConfig | ElasticConnectorConfig | DatadogConnectorConfig;
+export declare const connectorConfigSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"splunk">;
+    hecUrl: z.ZodString;
+    token: z.ZodString;
+    index: z.ZodOptional<z.ZodString>;
+    sourcetype: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+    host: z.ZodOptional<z.ZodString>;
+    verifySsl: z.ZodDefault<z.ZodBoolean>;
+    defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    token?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "splunk";
+    host?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    index?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    sourcetype?: string;
+    hecUrl?: string;
+    verifySsl?: boolean;
+    defaultFields?: Record<string, string>;
+}, {
+    timeout?: number;
+    token?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "splunk";
+    host?: string;
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    index?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    sourcetype?: string;
+    hecUrl?: string;
+    verifySsl?: boolean;
+    defaultFields?: Record<string, string>;
+}>, z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"elastic">;
+    nodes: z.ZodArray<z.ZodString, "many">;
+    auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    bearerToken: z.ZodOptional<z.ZodString>;
+    cloudId: z.ZodOptional<z.ZodString>;
+    index: z.ZodString;
+    pipeline: z.ZodOptional<z.ZodString>;
+    verifySsl: z.ZodDefault<z.ZodBoolean>;
+    refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
+    caCert: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    password?: string;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "elastic";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    index?: string;
+    refresh?: "true" | "false" | "wait_for";
+    pipeline?: string;
+    batchSize?: number;
+    auth?: "apiKey" | "none" | "basic" | "bearer";
+    username?: string;
+    maxRetryDelayMs?: number;
+    nodes?: string[];
+    caCert?: string;
+    verifySsl?: boolean;
+    bearerToken?: string;
+    cloudId?: string;
+}, {
+    timeout?: number;
+    password?: string;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "elastic";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    index?: string;
+    refresh?: "true" | "false" | "wait_for";
+    pipeline?: string;
+    batchSize?: number;
+    auth?: "apiKey" | "none" | "basic" | "bearer";
+    username?: string;
+    maxRetryDelayMs?: number;
+    nodes?: string[];
+    caCert?: string;
+    verifySsl?: boolean;
+    bearerToken?: string;
+    cloudId?: string;
+}>, z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    timeout: z.ZodDefault<z.ZodNumber>;
+    maxRetries: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+} & {
+    type: z.ZodLiteral<"datadog">;
+    site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
+    apiKey: z.ZodString;
+    service: z.ZodString;
+    source: z.ZodOptional<z.ZodString>;
+    hostname: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    compress: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    service?: string;
+    timeout?: number;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "datadog";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    tags?: string[];
+    hostname?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+    compress?: boolean;
+}, {
+    service?: string;
+    timeout?: number;
+    apiKey?: string;
+    name?: string;
+    enabled?: boolean;
+    type?: "datadog";
+    maxRetries?: number;
+    retryDelayMs?: number;
+    source?: string;
+    tags?: string[];
+    hostname?: string;
+    batchSize?: number;
+    maxRetryDelayMs?: number;
+    site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+    compress?: boolean;
+}>]>;
+/**
+ * Event output format
+ */
+export declare const EventFormat: {
+    readonly JSON: "json";
+    readonly CEF: "cef";
+    readonly SYSLOG: "syslog";
+};
+export type EventFormat = (typeof EventFormat)[keyof typeof EventFormat];
+export declare const eventFormatSchema: z.ZodNativeEnum<{
+    readonly JSON: "json";
+    readonly CEF: "cef";
+    readonly SYSLOG: "syslog";
+}>;
+/**
+ * CEF format configuration
+ */
+export interface CEFConfig {
+    /** CEF vendor name */
+    vendor: string;
+    /** CEF product name */
+    product: string;
+    /** CEF product version */
+    version: string;
+    /** Device event class ID prefix */
+    deviceEventClassIdPrefix?: string;
+}
+export declare const cefConfigSchema: z.ZodObject<{
+    vendor: z.ZodString;
+    product: z.ZodString;
+    version: z.ZodString;
+    deviceEventClassIdPrefix: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    version?: string;
+    vendor?: string;
+    product?: string;
+    deviceEventClassIdPrefix?: string;
+}, {
+    version?: string;
+    vendor?: string;
+    product?: string;
+    deviceEventClassIdPrefix?: string;
+}>;
+/**
+ * Syslog format configuration (RFC 5424)
+ */
+export interface SyslogConfig {
+    /** Syslog facility (0-23) */
+    facility: number;
+    /** Application name */
+    appName: string;
+    /** Process ID */
+    procId?: string;
+    /** Message ID */
+    msgId?: string;
+    /** Include structured data */
+    includeStructuredData?: boolean;
+}
+export declare const syslogConfigSchema: z.ZodObject<{
+    facility: z.ZodNumber;
+    appName: z.ZodString;
+    procId: z.ZodOptional<z.ZodString>;
+    msgId: z.ZodOptional<z.ZodString>;
+    includeStructuredData: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    facility?: number;
+    appName?: string;
+    procId?: string;
+    msgId?: string;
+    includeStructuredData?: boolean;
+}, {
+    facility?: number;
+    appName?: string;
+    procId?: string;
+    msgId?: string;
+    includeStructuredData?: boolean;
+}>;
+/**
+ * Geo-location enrichment configuration
+ */
+export interface GeoEnrichmentConfig {
+    /** Whether geo enrichment is enabled */
+    enabled: boolean;
+    /** IP fields to enrich */
+    ipFields?: string[];
+    /** GeoIP database path */
+    databasePath?: string;
+    /** GeoIP service URL */
+    serviceUrl?: string;
+    /** Cache TTL in seconds */
+    cacheTtlSeconds?: number;
+}
+export declare const geoEnrichmentConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    databasePath: z.ZodOptional<z.ZodString>;
+    serviceUrl: z.ZodOptional<z.ZodString>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    ipFields?: string[];
+    databasePath?: string;
+    serviceUrl?: string;
+}, {
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    ipFields?: string[];
+    databasePath?: string;
+    serviceUrl?: string;
+}>;
+/**
+ * Threat intelligence enrichment configuration
+ */
+export interface ThreatEnrichmentConfig {
+    /** Whether threat enrichment is enabled */
+    enabled: boolean;
+    /** Threat intel service URL */
+    serviceUrl?: string;
+    /** API key for threat intel service */
+    apiKey?: string;
+    /** Fields to check for indicators */
+    indicatorFields?: string[];
+    /** Cache TTL in seconds */
+    cacheTtlSeconds?: number;
+}
+export declare const threatEnrichmentConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    serviceUrl: z.ZodOptional<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    apiKey?: string;
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    serviceUrl?: string;
+    indicatorFields?: string[];
+}, {
+    apiKey?: string;
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    serviceUrl?: string;
+    indicatorFields?: string[];
+}>;
+/**
+ * User context enrichment configuration
+ */
+export interface UserEnrichmentConfig {
+    /** Whether user enrichment is enabled */
+    enabled: boolean;
+    /** User service URL */
+    serviceUrl?: string;
+    /** Include roles */
+    includeRoles?: boolean;
+    /** Include groups */
+    includeGroups?: boolean;
+    /** Include tenant info */
+    includeTenant?: boolean;
+    /** Cache TTL in seconds */
+    cacheTtlSeconds?: number;
+}
+export declare const userEnrichmentConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    serviceUrl: z.ZodOptional<z.ZodString>;
+    includeRoles: z.ZodDefault<z.ZodBoolean>;
+    includeGroups: z.ZodDefault<z.ZodBoolean>;
+    includeTenant: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    serviceUrl?: string;
+    includeRoles?: boolean;
+    includeGroups?: boolean;
+    includeTenant?: boolean;
+}, {
+    enabled?: boolean;
+    cacheTtlSeconds?: number;
+    serviceUrl?: string;
+    includeRoles?: boolean;
+    includeGroups?: boolean;
+    includeTenant?: boolean;
+}>;
+/**
+ * Combined enrichment configuration
+ */
+export interface EnrichmentConfig {
+    /** Geo-location enrichment */
+    geo?: GeoEnrichmentConfig;
+    /** Threat intelligence enrichment */
+    threat?: ThreatEnrichmentConfig;
+    /** User context enrichment */
+    user?: UserEnrichmentConfig;
+    /** Field name normalization mapping */
+    fieldNormalization?: Record<string, string>;
+}
+export declare const enrichmentConfigSchema: z.ZodObject<{
+    geo: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        databasePath: z.ZodOptional<z.ZodString>;
+        serviceUrl: z.ZodOptional<z.ZodString>;
+        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        ipFields?: string[];
+        databasePath?: string;
+        serviceUrl?: string;
+    }, {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        ipFields?: string[];
+        databasePath?: string;
+        serviceUrl?: string;
+    }>>;
+    threat: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        serviceUrl: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        apiKey?: string;
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        indicatorFields?: string[];
+    }, {
+        apiKey?: string;
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        indicatorFields?: string[];
+    }>>;
+    user: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        serviceUrl: z.ZodOptional<z.ZodString>;
+        includeRoles: z.ZodDefault<z.ZodBoolean>;
+        includeGroups: z.ZodDefault<z.ZodBoolean>;
+        includeTenant: z.ZodDefault<z.ZodBoolean>;
+        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        includeRoles?: boolean;
+        includeGroups?: boolean;
+        includeTenant?: boolean;
+    }, {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        includeRoles?: boolean;
+        includeGroups?: boolean;
+        includeTenant?: boolean;
+    }>>;
+    fieldNormalization: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    user?: {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        includeRoles?: boolean;
+        includeGroups?: boolean;
+        includeTenant?: boolean;
+    };
+    threat?: {
+        apiKey?: string;
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        indicatorFields?: string[];
+    };
+    geo?: {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        ipFields?: string[];
+        databasePath?: string;
+        serviceUrl?: string;
+    };
+    fieldNormalization?: Record<string, string>;
+}, {
+    user?: {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        includeRoles?: boolean;
+        includeGroups?: boolean;
+        includeTenant?: boolean;
+    };
+    threat?: {
+        apiKey?: string;
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        serviceUrl?: string;
+        indicatorFields?: string[];
+    };
+    geo?: {
+        enabled?: boolean;
+        cacheTtlSeconds?: number;
+        ipFields?: string[];
+        databasePath?: string;
+        serviceUrl?: string;
+    };
+    fieldNormalization?: Record<string, string>;
+}>;
+/**
+ * SIEM service configuration
+ */
+export interface SIEMConfig {
+    /** List of connector configurations */
+    connectors: ConnectorConfig[];
+    /** Batch size for buffering */
+    batchSize: number;
+    /** Flush interval in milliseconds */
+    flushIntervalMs: number;
+    /** Enabled event types (empty = all) */
+    enabledEventTypes: string[];
+    /** Enrichment configuration */
+    enrichment: EnrichmentConfig;
+    /** Default event format */
+    defaultFormat?: EventFormat;
+    /** CEF configuration */
+    cef?: CEFConfig;
+    /** Syslog configuration */
+    syslog?: SyslogConfig;
+    /** Circuit breaker failure threshold */
+    circuitBreakerThreshold?: number;
+    /** Circuit breaker reset timeout in ms */
+    circuitBreakerResetMs?: number;
+    /** Whether to log events to console (for debugging) */
+    debugLogging?: boolean;
+    /** Redis key prefix for metrics */
+    redisKeyPrefix?: string;
+}
+export declare const siemConfigSchema: z.ZodObject<{
+    connectors: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+        maxRetries: z.ZodDefault<z.ZodNumber>;
+        retryDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+        batchSize: z.ZodDefault<z.ZodNumber>;
+    } & {
+        type: z.ZodLiteral<"splunk">;
+        hecUrl: z.ZodString;
+        token: z.ZodString;
+        index: z.ZodOptional<z.ZodString>;
+        sourcetype: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        verifySsl: z.ZodDefault<z.ZodBoolean>;
+        defaultFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        timeout?: number;
+        token?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "splunk";
+        host?: string;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        index?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        sourcetype?: string;
+        hecUrl?: string;
+        verifySsl?: boolean;
+        defaultFields?: Record<string, string>;
+    }, {
+        timeout?: number;
+        token?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "splunk";
+        host?: string;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        index?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        sourcetype?: string;
+        hecUrl?: string;
+        verifySsl?: boolean;
+        defaultFields?: Record<string, string>;
+    }>, z.ZodObject<{
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+        maxRetries: z.ZodDefault<z.ZodNumber>;
+        retryDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+        batchSize: z.ZodDefault<z.ZodNumber>;
+    } & {
+        type: z.ZodLiteral<"elastic">;
+        nodes: z.ZodArray<z.ZodString, "many">;
+        auth: z.ZodEnum<["apiKey", "basic", "bearer", "none"]>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+        bearerToken: z.ZodOptional<z.ZodString>;
+        cloudId: z.ZodOptional<z.ZodString>;
+        index: z.ZodString;
+        pipeline: z.ZodOptional<z.ZodString>;
+        verifySsl: z.ZodDefault<z.ZodBoolean>;
+        refresh: z.ZodOptional<z.ZodEnum<["true", "false", "wait_for"]>>;
+        caCert: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        timeout?: number;
+        password?: string;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "elastic";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        index?: string;
+        refresh?: "true" | "false" | "wait_for";
+        pipeline?: string;
+        batchSize?: number;
+        auth?: "apiKey" | "none" | "basic" | "bearer";
+        username?: string;
+        maxRetryDelayMs?: number;
+        nodes?: string[];
+        caCert?: string;
+        verifySsl?: boolean;
+        bearerToken?: string;
+        cloudId?: string;
+    }, {
+        timeout?: number;
+        password?: string;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "elastic";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        index?: string;
+        refresh?: "true" | "false" | "wait_for";
+        pipeline?: string;
+        batchSize?: number;
+        auth?: "apiKey" | "none" | "basic" | "bearer";
+        username?: string;
+        maxRetryDelayMs?: number;
+        nodes?: string[];
+        caCert?: string;
+        verifySsl?: boolean;
+        bearerToken?: string;
+        cloudId?: string;
+    }>, z.ZodObject<{
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        timeout: z.ZodDefault<z.ZodNumber>;
+        maxRetries: z.ZodDefault<z.ZodNumber>;
+        retryDelayMs: z.ZodDefault<z.ZodNumber>;
+        maxRetryDelayMs: z.ZodDefault<z.ZodNumber>;
+        batchSize: z.ZodDefault<z.ZodNumber>;
+    } & {
+        type: z.ZodLiteral<"datadog">;
+        site: z.ZodEnum<["us1", "us3", "us5", "eu1", "ap1"]>;
+        apiKey: z.ZodString;
+        service: z.ZodString;
+        source: z.ZodOptional<z.ZodString>;
+        hostname: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        compress: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        service?: string;
+        timeout?: number;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "datadog";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        tags?: string[];
+        hostname?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+        compress?: boolean;
+    }, {
+        service?: string;
+        timeout?: number;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "datadog";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        tags?: string[];
+        hostname?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+        compress?: boolean;
+    }>]>, "many">>;
+    batchSize: z.ZodDefault<z.ZodNumber>;
+    flushIntervalMs: z.ZodDefault<z.ZodNumber>;
+    enabledEventTypes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    enrichment: z.ZodDefault<z.ZodObject<{
+        geo: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            ipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            databasePath: z.ZodOptional<z.ZodString>;
+            serviceUrl: z.ZodOptional<z.ZodString>;
+            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        }, {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        }>>;
+        threat: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            serviceUrl: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            indicatorFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        }, {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        }>>;
+        user: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            serviceUrl: z.ZodOptional<z.ZodString>;
+            includeRoles: z.ZodDefault<z.ZodBoolean>;
+            includeGroups: z.ZodDefault<z.ZodBoolean>;
+            includeTenant: z.ZodDefault<z.ZodBoolean>;
+            cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        }, {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        }>>;
+        fieldNormalization: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        user?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        };
+        threat?: {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        };
+        geo?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        };
+        fieldNormalization?: Record<string, string>;
+    }, {
+        user?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        };
+        threat?: {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        };
+        geo?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        };
+        fieldNormalization?: Record<string, string>;
+    }>>;
+    defaultFormat: z.ZodOptional<z.ZodNativeEnum<{
+        readonly JSON: "json";
+        readonly CEF: "cef";
+        readonly SYSLOG: "syslog";
+    }>>;
+    cef: z.ZodOptional<z.ZodObject<{
+        vendor: z.ZodString;
+        product: z.ZodString;
+        version: z.ZodString;
+        deviceEventClassIdPrefix: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        version?: string;
+        vendor?: string;
+        product?: string;
+        deviceEventClassIdPrefix?: string;
+    }, {
+        version?: string;
+        vendor?: string;
+        product?: string;
+        deviceEventClassIdPrefix?: string;
+    }>>;
+    syslog: z.ZodOptional<z.ZodObject<{
+        facility: z.ZodNumber;
+        appName: z.ZodString;
+        procId: z.ZodOptional<z.ZodString>;
+        msgId: z.ZodOptional<z.ZodString>;
+        includeStructuredData: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        facility?: number;
+        appName?: string;
+        procId?: string;
+        msgId?: string;
+        includeStructuredData?: boolean;
+    }, {
+        facility?: number;
+        appName?: string;
+        procId?: string;
+        msgId?: string;
+        includeStructuredData?: boolean;
+    }>>;
+    circuitBreakerThreshold: z.ZodDefault<z.ZodNumber>;
+    circuitBreakerResetMs: z.ZodDefault<z.ZodNumber>;
+    debugLogging: z.ZodDefault<z.ZodBoolean>;
+    redisKeyPrefix: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    batchSize?: number;
+    redisKeyPrefix?: string;
+    circuitBreakerThreshold?: number;
+    circuitBreakerResetMs?: number;
+    flushIntervalMs?: number;
+    cef?: {
+        version?: string;
+        vendor?: string;
+        product?: string;
+        deviceEventClassIdPrefix?: string;
+    };
+    syslog?: {
+        facility?: number;
+        appName?: string;
+        procId?: string;
+        msgId?: string;
+        includeStructuredData?: boolean;
+    };
+    connectors?: ({
+        timeout?: number;
+        token?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "splunk";
+        host?: string;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        index?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        sourcetype?: string;
+        hecUrl?: string;
+        verifySsl?: boolean;
+        defaultFields?: Record<string, string>;
+    } | {
+        timeout?: number;
+        password?: string;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "elastic";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        index?: string;
+        refresh?: "true" | "false" | "wait_for";
+        pipeline?: string;
+        batchSize?: number;
+        auth?: "apiKey" | "none" | "basic" | "bearer";
+        username?: string;
+        maxRetryDelayMs?: number;
+        nodes?: string[];
+        caCert?: string;
+        verifySsl?: boolean;
+        bearerToken?: string;
+        cloudId?: string;
+    } | {
+        service?: string;
+        timeout?: number;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "datadog";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        tags?: string[];
+        hostname?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+        compress?: boolean;
+    })[];
+    enabledEventTypes?: string[];
+    enrichment?: {
+        user?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        };
+        threat?: {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        };
+        geo?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        };
+        fieldNormalization?: Record<string, string>;
+    };
+    defaultFormat?: "json" | "cef" | "syslog";
+    debugLogging?: boolean;
+}, {
+    batchSize?: number;
+    redisKeyPrefix?: string;
+    circuitBreakerThreshold?: number;
+    circuitBreakerResetMs?: number;
+    flushIntervalMs?: number;
+    cef?: {
+        version?: string;
+        vendor?: string;
+        product?: string;
+        deviceEventClassIdPrefix?: string;
+    };
+    syslog?: {
+        facility?: number;
+        appName?: string;
+        procId?: string;
+        msgId?: string;
+        includeStructuredData?: boolean;
+    };
+    connectors?: ({
+        timeout?: number;
+        token?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "splunk";
+        host?: string;
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        index?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        sourcetype?: string;
+        hecUrl?: string;
+        verifySsl?: boolean;
+        defaultFields?: Record<string, string>;
+    } | {
+        timeout?: number;
+        password?: string;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "elastic";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        index?: string;
+        refresh?: "true" | "false" | "wait_for";
+        pipeline?: string;
+        batchSize?: number;
+        auth?: "apiKey" | "none" | "basic" | "bearer";
+        username?: string;
+        maxRetryDelayMs?: number;
+        nodes?: string[];
+        caCert?: string;
+        verifySsl?: boolean;
+        bearerToken?: string;
+        cloudId?: string;
+    } | {
+        service?: string;
+        timeout?: number;
+        apiKey?: string;
+        name?: string;
+        enabled?: boolean;
+        type?: "datadog";
+        maxRetries?: number;
+        retryDelayMs?: number;
+        source?: string;
+        tags?: string[];
+        hostname?: string;
+        batchSize?: number;
+        maxRetryDelayMs?: number;
+        site?: "us1" | "us3" | "us5" | "eu1" | "ap1";
+        compress?: boolean;
+    })[];
+    enabledEventTypes?: string[];
+    enrichment?: {
+        user?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            includeRoles?: boolean;
+            includeGroups?: boolean;
+            includeTenant?: boolean;
+        };
+        threat?: {
+            apiKey?: string;
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            serviceUrl?: string;
+            indicatorFields?: string[];
+        };
+        geo?: {
+            enabled?: boolean;
+            cacheTtlSeconds?: number;
+            ipFields?: string[];
+            databasePath?: string;
+            serviceUrl?: string;
+        };
+        fieldNormalization?: Record<string, string>;
+    };
+    defaultFormat?: "json" | "cef" | "syslog";
+    debugLogging?: boolean;
+}>;
+/**
+ * Default SIEM configuration
+ */
+export declare const DEFAULT_SIEM_CONFIG: Partial<SIEMConfig>;
+/**
+ * SIEM connector metrics
+ */
+export interface SIEMMetrics {
+    /** Total events sent */
+    eventsSent: number;
+    /** Total events failed */
+    eventsFailed: number;
+    /** Total batches sent */
+    batchesSent: number;
+    /** Total batches failed */
+    batchesFailed: number;
+    /** Average latency in ms */
+    avgLatencyMs: number;
+    /** Events in current buffer */
+    bufferSize: number;
+    /** Connector status by name */
+    connectorStatus: Record<string, 'connected' | 'disconnected' | 'circuit_open'>;
+    /** Last send timestamp */
+    lastSendTime?: Date;
+    /** Last error */
+    lastError?: string;
+}
+/**
+ * Event filter function
+ */
+export type EventFilter = (event: SecurityEvent) => boolean;
+/**
+ * Event transformer function
+ */
+export type EventTransformer = (event: SecurityEvent) => SecurityEvent;
+/**
+ * Hook for integration with other systems
+ */
+export interface IntegrationHook {
+    /** Hook name */
+    name: string;
+    /** Event types to handle (empty = all) */
+    eventTypes: string[];
+    /** Filter function */
+    filter?: EventFilter;
+    /** Transformer function */
+    transformer?: EventTransformer;
+    /** Whether hook is enabled */
+    enabled: boolean;
+}
+//# sourceMappingURL=types.d.ts.map