@vorionsys/security 1.0.0

package/dist/security/incident/types.d.ts

@@ -0,0 +1,1517 @@
+/**
+ * Incident Response System - Type Definitions
+ *
+ * Comprehensive type definitions for incident management,
+ * playbook execution, and notification handling.
+ */
+import { z } from 'zod';
+export declare const IncidentSeverity: {
+    readonly P1: "P1";
+    readonly P2: "P2";
+    readonly P3: "P3";
+    readonly P4: "P4";
+};
+export type IncidentSeverity = (typeof IncidentSeverity)[keyof typeof IncidentSeverity];
+export declare const IncidentStatus: {
+    readonly DETECTED: "detected";
+    readonly INVESTIGATING: "investigating";
+    readonly CONTAINED: "contained";
+    readonly ERADICATED: "eradicated";
+    readonly RECOVERED: "recovered";
+    readonly CLOSED: "closed";
+};
+export type IncidentStatus = (typeof IncidentStatus)[keyof typeof IncidentStatus];
+export declare const IncidentType: {
+    readonly DATA_BREACH: "data_breach";
+    readonly ACCOUNT_COMPROMISE: "account_compromise";
+    readonly MALWARE: "malware";
+    readonly DENIAL_OF_SERVICE: "denial_of_service";
+    readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
+    readonly INSIDER_THREAT: "insider_threat";
+    readonly PHISHING: "phishing";
+    readonly RANSOMWARE: "ransomware";
+    readonly CONFIGURATION_ERROR: "configuration_error";
+    readonly OTHER: "other";
+};
+export type IncidentType = (typeof IncidentType)[keyof typeof IncidentType];
+export declare const StepType: {
+    readonly MANUAL: "manual";
+    readonly AUTOMATED: "automated";
+};
+export type StepType = (typeof StepType)[keyof typeof StepType];
+export declare const NotificationChannel: {
+    readonly SLACK: "slack";
+    readonly EMAIL: "email";
+    readonly PAGERDUTY: "pagerduty";
+    readonly WEBHOOK: "webhook";
+    readonly SMS: "sms";
+};
+export type NotificationChannel = (typeof NotificationChannel)[keyof typeof NotificationChannel];
+export declare const TimelineEntryType: {
+    readonly CREATED: "created";
+    readonly STATUS_CHANGE: "status_change";
+    readonly ASSIGNMENT: "assignment";
+    readonly COMMENT: "comment";
+    readonly EVIDENCE_ADDED: "evidence_added";
+    readonly PLAYBOOK_STARTED: "playbook_started";
+    readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
+    readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
+    readonly NOTIFICATION_SENT: "notification_sent";
+    readonly ESCALATION: "escalation";
+    readonly RESOLUTION: "resolution";
+};
+export type TimelineEntryType = (typeof TimelineEntryType)[keyof typeof TimelineEntryType];
+export declare const EvidenceSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    source: z.ZodString;
+    collectedAt: z.ZodDate;
+    collectedBy: z.ZodString;
+    hash: z.ZodOptional<z.ZodString>;
+    size: z.ZodOptional<z.ZodNumber>;
+    location: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+    name?: string;
+    location?: string;
+    description?: string;
+    source?: string;
+    metadata?: Record<string, unknown>;
+    hash?: string;
+    size?: number;
+    collectedAt?: Date;
+    collectedBy?: string;
+}, {
+    id?: string;
+    type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+    name?: string;
+    location?: string;
+    description?: string;
+    source?: string;
+    metadata?: Record<string, unknown>;
+    hash?: string;
+    size?: number;
+    collectedAt?: Date;
+    collectedBy?: string;
+}>;
+export type Evidence = z.infer<typeof EvidenceSchema>;
+export declare const TimelineEntrySchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    type: z.ZodNativeEnum<{
+        readonly CREATED: "created";
+        readonly STATUS_CHANGE: "status_change";
+        readonly ASSIGNMENT: "assignment";
+        readonly COMMENT: "comment";
+        readonly EVIDENCE_ADDED: "evidence_added";
+        readonly PLAYBOOK_STARTED: "playbook_started";
+        readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
+        readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
+        readonly NOTIFICATION_SENT: "notification_sent";
+        readonly ESCALATION: "escalation";
+        readonly RESOLUTION: "resolution";
+    }>;
+    actor: z.ZodString;
+    description: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    automated: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+    timestamp?: Date;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    actor?: string;
+    automated?: boolean;
+}, {
+    id?: string;
+    type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+    timestamp?: Date;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    actor?: string;
+    automated?: boolean;
+}>;
+export type TimelineEntry = z.infer<typeof TimelineEntrySchema>;
+export declare const TriggerConditionSchema: z.ZodObject<{
+    field: z.ZodString;
+    operator: z.ZodEnum<["equals", "contains", "matches", "gt", "lt", "gte", "lte", "in", "not_in"]>;
+    value: z.ZodUnknown;
+    logicalOperator: z.ZodOptional<z.ZodEnum<["and", "or"]>>;
+}, "strip", z.ZodTypeAny, {
+    value?: unknown;
+    field?: string;
+    operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+    logicalOperator?: "and" | "or";
+}, {
+    value?: unknown;
+    field?: string;
+    operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+    logicalOperator?: "and" | "or";
+}>;
+export type TriggerCondition = z.infer<typeof TriggerConditionSchema>;
+export declare const NotificationConfigSchema: z.ZodObject<{
+    channel: z.ZodNativeEnum<{
+        readonly SLACK: "slack";
+        readonly EMAIL: "email";
+        readonly PAGERDUTY: "pagerduty";
+        readonly WEBHOOK: "webhook";
+        readonly SMS: "sms";
+    }>;
+    target: z.ZodString;
+    template: z.ZodOptional<z.ZodString>;
+    severityFilter: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
+        readonly P1: "P1";
+        readonly P2: "P2";
+        readonly P3: "P3";
+        readonly P4: "P4";
+    }>, "many">>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    retryAttempts: z.ZodDefault<z.ZodNumber>;
+    retryDelayMs: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    target?: string;
+    retryDelayMs?: number;
+    channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+    enabled?: boolean;
+    retryAttempts?: number;
+    severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+    template?: string;
+}, {
+    target?: string;
+    retryDelayMs?: number;
+    channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+    enabled?: boolean;
+    retryAttempts?: number;
+    severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+    template?: string;
+}>;
+export type NotificationConfig = z.infer<typeof NotificationConfigSchema>;
+export declare const EscalationLevelSchema: z.ZodObject<{
+    level: z.ZodNumber;
+    afterMinutes: z.ZodNumber;
+    targets: z.ZodArray<z.ZodString, "many">;
+    channels: z.ZodArray<z.ZodNativeEnum<{
+        readonly SLACK: "slack";
+        readonly EMAIL: "email";
+        readonly PAGERDUTY: "pagerduty";
+        readonly WEBHOOK: "webhook";
+        readonly SMS: "sms";
+    }>, "many">;
+    message: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    message?: string;
+    level?: number;
+    channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+    afterMinutes?: number;
+    targets?: string[];
+}, {
+    message?: string;
+    level?: number;
+    channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+    afterMinutes?: number;
+    targets?: string[];
+}>;
+export type EscalationLevel = z.infer<typeof EscalationLevelSchema>;
+export declare const EscalationConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    levels: z.ZodArray<z.ZodObject<{
+        level: z.ZodNumber;
+        afterMinutes: z.ZodNumber;
+        targets: z.ZodArray<z.ZodString, "many">;
+        channels: z.ZodArray<z.ZodNativeEnum<{
+            readonly SLACK: "slack";
+            readonly EMAIL: "email";
+            readonly PAGERDUTY: "pagerduty";
+            readonly WEBHOOK: "webhook";
+            readonly SMS: "sms";
+        }>, "many">;
+        message: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        message?: string;
+        level?: number;
+        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+        afterMinutes?: number;
+        targets?: string[];
+    }, {
+        message?: string;
+        level?: number;
+        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+        afterMinutes?: number;
+        targets?: string[];
+    }>, "many">;
+    maxLevel: z.ZodDefault<z.ZodNumber>;
+    resetOnAcknowledge: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    levels?: {
+        message?: string;
+        level?: number;
+        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+        afterMinutes?: number;
+        targets?: string[];
+    }[];
+    enabled?: boolean;
+    maxLevel?: number;
+    resetOnAcknowledge?: boolean;
+}, {
+    levels?: {
+        message?: string;
+        level?: number;
+        channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+        afterMinutes?: number;
+        targets?: string[];
+    }[];
+    enabled?: boolean;
+    maxLevel?: number;
+    resetOnAcknowledge?: boolean;
+}>;
+export type EscalationConfig = z.infer<typeof EscalationConfigSchema>;
+export declare const PlaybookStepSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodNativeEnum<{
+        readonly MANUAL: "manual";
+        readonly AUTOMATED: "automated";
+    }>;
+    description: z.ZodString;
+    action: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+    actionId: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+    requiresApproval: z.ZodDefault<z.ZodBoolean>;
+    approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    onFailure: z.ZodDefault<z.ZodEnum<["continue", "halt", "retry"]>>;
+    retryAttempts: z.ZodDefault<z.ZodNumber>;
+    dependencies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "manual" | "automated";
+    name?: string;
+    timeout?: number;
+    description?: string;
+    dependencies?: string[];
+    retryAttempts?: number;
+    metadata?: Record<string, unknown>;
+    action?: (...args: unknown[]) => Promise<void>;
+    actionId?: string;
+    approvers?: string[];
+    requiresApproval?: boolean;
+    onFailure?: "retry" | "continue" | "halt";
+}, {
+    id?: string;
+    type?: "manual" | "automated";
+    name?: string;
+    timeout?: number;
+    description?: string;
+    dependencies?: string[];
+    retryAttempts?: number;
+    metadata?: Record<string, unknown>;
+    action?: (...args: unknown[]) => Promise<void>;
+    actionId?: string;
+    approvers?: string[];
+    requiresApproval?: boolean;
+    onFailure?: "retry" | "continue" | "halt";
+}>;
+export type PlaybookStep = z.infer<typeof PlaybookStepSchema>;
+/**
+ * Input type for creating playbook steps - allows optional fields with defaults
+ */
+export type PlaybookStepInput = Omit<PlaybookStep, 'requiresApproval' | 'onFailure' | 'retryAttempts'> & {
+    requiresApproval?: boolean;
+    onFailure?: 'continue' | 'halt' | 'retry';
+    retryAttempts?: number;
+    actionId?: string;
+};
+export declare const PlaybookSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    version: z.ZodDefault<z.ZodString>;
+    triggerConditions: z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        operator: z.ZodEnum<["equals", "contains", "matches", "gt", "lt", "gte", "lte", "in", "not_in"]>;
+        value: z.ZodUnknown;
+        logicalOperator: z.ZodOptional<z.ZodEnum<["and", "or"]>>;
+    }, "strip", z.ZodTypeAny, {
+        value?: unknown;
+        field?: string;
+        operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+        logicalOperator?: "and" | "or";
+    }, {
+        value?: unknown;
+        field?: string;
+        operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+        logicalOperator?: "and" | "or";
+    }>, "many">;
+    steps: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodNativeEnum<{
+            readonly MANUAL: "manual";
+            readonly AUTOMATED: "automated";
+        }>;
+        description: z.ZodString;
+        action: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        actionId: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+        requiresApproval: z.ZodDefault<z.ZodBoolean>;
+        approvers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        onFailure: z.ZodDefault<z.ZodEnum<["continue", "halt", "retry"]>>;
+        retryAttempts: z.ZodDefault<z.ZodNumber>;
+        dependencies: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "manual" | "automated";
+        name?: string;
+        timeout?: number;
+        description?: string;
+        dependencies?: string[];
+        retryAttempts?: number;
+        metadata?: Record<string, unknown>;
+        action?: (...args: unknown[]) => Promise<void>;
+        actionId?: string;
+        approvers?: string[];
+        requiresApproval?: boolean;
+        onFailure?: "retry" | "continue" | "halt";
+    }, {
+        id?: string;
+        type?: "manual" | "automated";
+        name?: string;
+        timeout?: number;
+        description?: string;
+        dependencies?: string[];
+        retryAttempts?: number;
+        metadata?: Record<string, unknown>;
+        action?: (...args: unknown[]) => Promise<void>;
+        actionId?: string;
+        approvers?: string[];
+        requiresApproval?: boolean;
+        onFailure?: "retry" | "continue" | "halt";
+    }>, "many">;
+    notifications: z.ZodArray<z.ZodObject<{
+        channel: z.ZodNativeEnum<{
+            readonly SLACK: "slack";
+            readonly EMAIL: "email";
+            readonly PAGERDUTY: "pagerduty";
+            readonly WEBHOOK: "webhook";
+            readonly SMS: "sms";
+        }>;
+        target: z.ZodString;
+        template: z.ZodOptional<z.ZodString>;
+        severityFilter: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
+            readonly P1: "P1";
+            readonly P2: "P2";
+            readonly P3: "P3";
+            readonly P4: "P4";
+        }>, "many">>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        retryAttempts: z.ZodDefault<z.ZodNumber>;
+        retryDelayMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        target?: string;
+        retryDelayMs?: number;
+        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+        enabled?: boolean;
+        retryAttempts?: number;
+        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+        template?: string;
+    }, {
+        target?: string;
+        retryDelayMs?: number;
+        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+        enabled?: boolean;
+        retryAttempts?: number;
+        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+        template?: string;
+    }>, "many">;
+    escalation: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        levels: z.ZodArray<z.ZodObject<{
+            level: z.ZodNumber;
+            afterMinutes: z.ZodNumber;
+            targets: z.ZodArray<z.ZodString, "many">;
+            channels: z.ZodArray<z.ZodNativeEnum<{
+                readonly SLACK: "slack";
+                readonly EMAIL: "email";
+                readonly PAGERDUTY: "pagerduty";
+                readonly WEBHOOK: "webhook";
+                readonly SMS: "sms";
+            }>, "many">;
+            message: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }, {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }>, "many">;
+        maxLevel: z.ZodDefault<z.ZodNumber>;
+        resetOnAcknowledge: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        levels?: {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }[];
+        enabled?: boolean;
+        maxLevel?: number;
+        resetOnAcknowledge?: boolean;
+    }, {
+        levels?: {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }[];
+        enabled?: boolean;
+        maxLevel?: number;
+        resetOnAcknowledge?: boolean;
+    }>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    createdAt: z.ZodOptional<z.ZodDate>;
+    updatedAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    createdAt?: Date;
+    name?: string;
+    version?: string;
+    tags?: string[];
+    description?: string;
+    enabled?: boolean;
+    updatedAt?: Date;
+    escalation?: {
+        levels?: {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }[];
+        enabled?: boolean;
+        maxLevel?: number;
+        resetOnAcknowledge?: boolean;
+    };
+    triggerConditions?: {
+        value?: unknown;
+        field?: string;
+        operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+        logicalOperator?: "and" | "or";
+    }[];
+    steps?: {
+        id?: string;
+        type?: "manual" | "automated";
+        name?: string;
+        timeout?: number;
+        description?: string;
+        dependencies?: string[];
+        retryAttempts?: number;
+        metadata?: Record<string, unknown>;
+        action?: (...args: unknown[]) => Promise<void>;
+        actionId?: string;
+        approvers?: string[];
+        requiresApproval?: boolean;
+        onFailure?: "retry" | "continue" | "halt";
+    }[];
+    notifications?: {
+        target?: string;
+        retryDelayMs?: number;
+        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+        enabled?: boolean;
+        retryAttempts?: number;
+        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+        template?: string;
+    }[];
+}, {
+    id?: string;
+    createdAt?: Date;
+    name?: string;
+    version?: string;
+    tags?: string[];
+    description?: string;
+    enabled?: boolean;
+    updatedAt?: Date;
+    escalation?: {
+        levels?: {
+            message?: string;
+            level?: number;
+            channels?: ("email" | "webhook" | "slack" | "pagerduty" | "sms")[];
+            afterMinutes?: number;
+            targets?: string[];
+        }[];
+        enabled?: boolean;
+        maxLevel?: number;
+        resetOnAcknowledge?: boolean;
+    };
+    triggerConditions?: {
+        value?: unknown;
+        field?: string;
+        operator?: "equals" | "contains" | "matches" | "in" | "not_in" | "gte" | "gt" | "lte" | "lt";
+        logicalOperator?: "and" | "or";
+    }[];
+    steps?: {
+        id?: string;
+        type?: "manual" | "automated";
+        name?: string;
+        timeout?: number;
+        description?: string;
+        dependencies?: string[];
+        retryAttempts?: number;
+        metadata?: Record<string, unknown>;
+        action?: (...args: unknown[]) => Promise<void>;
+        actionId?: string;
+        approvers?: string[];
+        requiresApproval?: boolean;
+        onFailure?: "retry" | "continue" | "halt";
+    }[];
+    notifications?: {
+        target?: string;
+        retryDelayMs?: number;
+        channel?: "email" | "webhook" | "slack" | "pagerduty" | "sms";
+        enabled?: boolean;
+        retryAttempts?: number;
+        severityFilter?: ("P1" | "P2" | "P3" | "P4")[];
+        template?: string;
+    }[];
+}>;
+export type Playbook = z.infer<typeof PlaybookSchema>;
+/**
+ * Input type for creating playbooks - allows optional fields with defaults
+ */
+export type PlaybookInput = Omit<Playbook, 'steps' | 'version' | 'enabled'> & {
+    steps: PlaybookStepInput[];
+    version?: string;
+    enabled?: boolean;
+};
+export declare const IncidentSchema: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    description: z.ZodString;
+    severity: z.ZodNativeEnum<{
+        readonly P1: "P1";
+        readonly P2: "P2";
+        readonly P3: "P3";
+        readonly P4: "P4";
+    }>;
+    status: z.ZodNativeEnum<{
+        readonly DETECTED: "detected";
+        readonly INVESTIGATING: "investigating";
+        readonly CONTAINED: "contained";
+        readonly ERADICATED: "eradicated";
+        readonly RECOVERED: "recovered";
+        readonly CLOSED: "closed";
+    }>;
+    type: z.ZodNativeEnum<{
+        readonly DATA_BREACH: "data_breach";
+        readonly ACCOUNT_COMPROMISE: "account_compromise";
+        readonly MALWARE: "malware";
+        readonly DENIAL_OF_SERVICE: "denial_of_service";
+        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
+        readonly INSIDER_THREAT: "insider_threat";
+        readonly PHISHING: "phishing";
+        readonly RANSOMWARE: "ransomware";
+        readonly CONFIGURATION_ERROR: "configuration_error";
+        readonly OTHER: "other";
+    }>;
+    detectedAt: z.ZodDate;
+    acknowledgedAt: z.ZodOptional<z.ZodDate>;
+    containedAt: z.ZodOptional<z.ZodDate>;
+    resolvedAt: z.ZodOptional<z.ZodDate>;
+    closedAt: z.ZodOptional<z.ZodDate>;
+    assignee: z.ZodOptional<z.ZodString>;
+    team: z.ZodOptional<z.ZodString>;
+    affectedResources: z.ZodArray<z.ZodString, "many">;
+    timeline: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodDate;
+        type: z.ZodNativeEnum<{
+            readonly CREATED: "created";
+            readonly STATUS_CHANGE: "status_change";
+            readonly ASSIGNMENT: "assignment";
+            readonly COMMENT: "comment";
+            readonly EVIDENCE_ADDED: "evidence_added";
+            readonly PLAYBOOK_STARTED: "playbook_started";
+            readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
+            readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
+            readonly NOTIFICATION_SENT: "notification_sent";
+            readonly ESCALATION: "escalation";
+            readonly RESOLUTION: "resolution";
+        }>;
+        actor: z.ZodString;
+        description: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        automated: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }, {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }>, "many">;
+    evidence: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        source: z.ZodString;
+        collectedAt: z.ZodDate;
+        collectedBy: z.ZodString;
+        hash: z.ZodOptional<z.ZodString>;
+        size: z.ZodOptional<z.ZodNumber>;
+        location: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }, {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }>, "many">;
+    playbook: z.ZodOptional<z.ZodString>;
+    playbookProgress: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["pending", "in_progress", "completed", "failed", "skipped"]>>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    externalReferences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }>, "many">>;
+    rootCause: z.ZodOptional<z.ZodString>;
+    remediation: z.ZodOptional<z.ZodString>;
+    lessonsLearned: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    resolvedAt?: Date;
+    acknowledgedAt?: Date;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    timeline?: {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }[];
+    assignee?: string;
+    team?: string;
+    detectedAt?: Date;
+    containedAt?: Date;
+    closedAt?: Date;
+    affectedResources?: string[];
+    evidence?: {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }[];
+    playbook?: string;
+    playbookProgress?: Record<string, "failed" | "pending" | "completed" | "in_progress" | "skipped">;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}, {
+    id?: string;
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    resolvedAt?: Date;
+    acknowledgedAt?: Date;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    timeline?: {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }[];
+    assignee?: string;
+    team?: string;
+    detectedAt?: Date;
+    containedAt?: Date;
+    closedAt?: Date;
+    affectedResources?: string[];
+    evidence?: {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }[];
+    playbook?: string;
+    playbookProgress?: Record<string, "failed" | "pending" | "completed" | "in_progress" | "skipped">;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}>;
+export type Incident = z.infer<typeof IncidentSchema>;
+export declare const CreateIncidentSchema: z.ZodObject<{
+    type: z.ZodNativeEnum<{
+        readonly DATA_BREACH: "data_breach";
+        readonly ACCOUNT_COMPROMISE: "account_compromise";
+        readonly MALWARE: "malware";
+        readonly DENIAL_OF_SERVICE: "denial_of_service";
+        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
+        readonly INSIDER_THREAT: "insider_threat";
+        readonly PHISHING: "phishing";
+        readonly RANSOMWARE: "ransomware";
+        readonly CONFIGURATION_ERROR: "configuration_error";
+        readonly OTHER: "other";
+    }>;
+    status: z.ZodNativeEnum<{
+        readonly DETECTED: "detected";
+        readonly INVESTIGATING: "investigating";
+        readonly CONTAINED: "contained";
+        readonly ERADICATED: "eradicated";
+        readonly RECOVERED: "recovered";
+        readonly CLOSED: "closed";
+    }>;
+    title: z.ZodString;
+    description: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    severity: z.ZodNativeEnum<{
+        readonly P1: "P1";
+        readonly P2: "P2";
+        readonly P3: "P3";
+        readonly P4: "P4";
+    }>;
+    assignee: z.ZodOptional<z.ZodString>;
+    team: z.ZodOptional<z.ZodString>;
+    detectedAt: z.ZodDate;
+    playbook: z.ZodOptional<z.ZodString>;
+    externalReferences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }>, "many">>;
+    rootCause: z.ZodOptional<z.ZodString>;
+    remediation: z.ZodOptional<z.ZodString>;
+    lessonsLearned: z.ZodOptional<z.ZodString>;
+} & {
+    affectedResources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    assignee?: string;
+    team?: string;
+    detectedAt?: Date;
+    affectedResources?: string[];
+    playbook?: string;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}, {
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    assignee?: string;
+    team?: string;
+    detectedAt?: Date;
+    affectedResources?: string[];
+    playbook?: string;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}>;
+export type CreateIncidentInput = z.infer<typeof CreateIncidentSchema>;
+export declare const UpdateIncidentSchema: z.ZodObject<Omit<{
+    id: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodNativeEnum<{
+        readonly P1: "P1";
+        readonly P2: "P2";
+        readonly P3: "P3";
+        readonly P4: "P4";
+    }>>;
+    status: z.ZodOptional<z.ZodNativeEnum<{
+        readonly DETECTED: "detected";
+        readonly INVESTIGATING: "investigating";
+        readonly CONTAINED: "contained";
+        readonly ERADICATED: "eradicated";
+        readonly RECOVERED: "recovered";
+        readonly CLOSED: "closed";
+    }>>;
+    type: z.ZodOptional<z.ZodNativeEnum<{
+        readonly DATA_BREACH: "data_breach";
+        readonly ACCOUNT_COMPROMISE: "account_compromise";
+        readonly MALWARE: "malware";
+        readonly DENIAL_OF_SERVICE: "denial_of_service";
+        readonly UNAUTHORIZED_ACCESS: "unauthorized_access";
+        readonly INSIDER_THREAT: "insider_threat";
+        readonly PHISHING: "phishing";
+        readonly RANSOMWARE: "ransomware";
+        readonly CONFIGURATION_ERROR: "configuration_error";
+        readonly OTHER: "other";
+    }>>;
+    detectedAt: z.ZodOptional<z.ZodDate>;
+    acknowledgedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
+    containedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
+    resolvedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
+    closedAt: z.ZodOptional<z.ZodOptional<z.ZodDate>>;
+    assignee: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    team: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    affectedResources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    timeline: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodDate;
+        type: z.ZodNativeEnum<{
+            readonly CREATED: "created";
+            readonly STATUS_CHANGE: "status_change";
+            readonly ASSIGNMENT: "assignment";
+            readonly COMMENT: "comment";
+            readonly EVIDENCE_ADDED: "evidence_added";
+            readonly PLAYBOOK_STARTED: "playbook_started";
+            readonly PLAYBOOK_STEP_COMPLETED: "playbook_step_completed";
+            readonly PLAYBOOK_STEP_FAILED: "playbook_step_failed";
+            readonly NOTIFICATION_SENT: "notification_sent";
+            readonly ESCALATION: "escalation";
+            readonly RESOLUTION: "resolution";
+        }>;
+        actor: z.ZodString;
+        description: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        automated: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }, {
+        id?: string;
+        type?: "resolution" | "escalation" | "created" | "comment" | "status_change" | "assignment" | "evidence_added" | "playbook_started" | "playbook_step_completed" | "playbook_step_failed" | "notification_sent";
+        timestamp?: Date;
+        description?: string;
+        metadata?: Record<string, unknown>;
+        actor?: string;
+        automated?: boolean;
+    }>, "many">>;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<["log", "screenshot", "file", "network_capture", "memory_dump", "configuration", "other"]>;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        source: z.ZodString;
+        collectedAt: z.ZodDate;
+        collectedBy: z.ZodString;
+        hash: z.ZodOptional<z.ZodString>;
+        size: z.ZodOptional<z.ZodNumber>;
+        location: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }, {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }>, "many">>;
+    playbook: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    playbookProgress: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["pending", "in_progress", "completed", "failed", "skipped"]>>>>;
+    tags: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    externalReferences: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }, {
+        id?: string;
+        type?: string;
+        url?: string;
+    }>, "many">>>;
+    rootCause: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    remediation: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    lessonsLearned: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, "id" | "timeline" | "detectedAt">, "strip", z.ZodTypeAny, {
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    resolvedAt?: Date;
+    acknowledgedAt?: Date;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    assignee?: string;
+    team?: string;
+    containedAt?: Date;
+    closedAt?: Date;
+    affectedResources?: string[];
+    evidence?: {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }[];
+    playbook?: string;
+    playbookProgress?: Record<string, "failed" | "pending" | "completed" | "in_progress" | "skipped">;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}, {
+    type?: "other" | "unauthorized_access" | "malware" | "data_breach" | "account_compromise" | "denial_of_service" | "insider_threat" | "phishing" | "ransomware" | "configuration_error";
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "recovered";
+    tags?: string[];
+    title?: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    resolvedAt?: Date;
+    acknowledgedAt?: Date;
+    severity?: "P1" | "P2" | "P3" | "P4";
+    assignee?: string;
+    team?: string;
+    containedAt?: Date;
+    closedAt?: Date;
+    affectedResources?: string[];
+    evidence?: {
+        id?: string;
+        type?: "log" | "other" | "configuration" | "file" | "screenshot" | "network_capture" | "memory_dump";
+        name?: string;
+        location?: string;
+        description?: string;
+        source?: string;
+        metadata?: Record<string, unknown>;
+        hash?: string;
+        size?: number;
+        collectedAt?: Date;
+        collectedBy?: string;
+    }[];
+    playbook?: string;
+    playbookProgress?: Record<string, "failed" | "pending" | "completed" | "in_progress" | "skipped">;
+    externalReferences?: {
+        id?: string;
+        type?: string;
+        url?: string;
+    }[];
+    rootCause?: string;
+    remediation?: string;
+    lessonsLearned?: string;
+}>;
+export type UpdateIncidentInput = z.infer<typeof UpdateIncidentSchema>;
+export interface IncidentReport {
+    incident: Incident;
+    generatedAt: Date;
+    generatedBy: string;
+    summary: {
+        duration: number;
+        timeToDetect?: number;
+        timeToContain?: number;
+        timeToResolve?: number;
+        escalationLevel: number;
+        playbookStepsCompleted: number;
+        playbookStepsTotal: number;
+        evidenceCount: number;
+        notificationsSent: number;
+    };
+    timelineFormatted: string;
+    impactAssessment?: string;
+    recommendations: string[];
+}
+export interface IncidentMetrics {
+    totalIncidents: number;
+    byStatus: Record<IncidentStatus, number>;
+    bySeverity: Record<IncidentSeverity, number>;
+    byType: Record<IncidentType, number>;
+    averageTimeToDetect: number;
+    averageTimeToContain: number;
+    averageTimeToResolve: number;
+    averageTimeToClose: number;
+}
+export interface IncidentEvent {
+    type: 'incident_created' | 'incident_updated' | 'incident_closed' | 'playbook_started' | 'playbook_completed' | 'playbook_failed' | 'step_completed' | 'step_failed' | 'escalation_triggered' | 'notification_sent' | 'evidence_added';
+    incidentId: string;
+    timestamp: Date;
+    data: Record<string, unknown>;
+}
+export type IncidentEventHandler = (event: IncidentEvent) => void | Promise<void>;
+export interface PlaybookExecutionContext {
+    incident: Incident;
+    playbook: Playbook;
+    currentStepIndex: number;
+    startedAt: Date;
+    completedSteps: string[];
+    failedSteps: string[];
+    skippedSteps: string[];
+    variables: Record<string, unknown>;
+}
+export interface StepExecutionResult {
+    stepId: string;
+    success: boolean;
+    startedAt: Date;
+    completedAt: Date;
+    duration: number;
+    output?: unknown;
+    error?: string;
+    retryCount: number;
+}
+export interface NotificationPayload {
+    incidentId: string;
+    title: string;
+    message: string;
+    severity: IncidentSeverity;
+    status: IncidentStatus;
+    url?: string;
+    additionalData?: Record<string, unknown>;
+}
+export interface NotificationResult {
+    channel: NotificationChannel;
+    target: string;
+    success: boolean;
+    sentAt: Date;
+    messageId?: string;
+    error?: string;
+    retryCount: number;
+}
+export interface IncidentManagerConfig {
+    defaultEscalation: EscalationConfig;
+    notificationDefaults: Partial<NotificationConfig>;
+    autoAssignment: {
+        enabled: boolean;
+        rules: Array<{
+            conditions: TriggerCondition[];
+            assignee: string;
+        }>;
+    };
+    retentionDays: number;
+    webhooks: {
+        slack?: string;
+        pagerduty?: string;
+        email?: {
+            host: string;
+            port: number;
+            secure: boolean;
+            auth?: {
+                user: string;
+                pass: string;
+            };
+        };
+        custom?: Array<{
+            name: string;
+            url: string;
+            headers?: Record<string, string>;
+        }>;
+    };
+    /** Automation configuration */
+    automation: {
+        /** Whether automated playbook execution is enabled */
+        enabled: boolean;
+        /** Maximum concurrent playbook executions */
+        maxConcurrentExecutions: number;
+        /** Default timeout for automated steps in milliseconds */
+        defaultStepTimeoutMs: number;
+        /** Whether to persist execution state */
+        persistState: boolean;
+        /** State storage configuration */
+        stateStorage?: {
+            type: 'memory' | 'redis' | 'database';
+            connectionString?: string;
+        };
+    };
+}
+/**
+ * Execution state for a playbook
+ */
+export declare const ExecutionState: {
+    readonly PENDING: "pending";
+    readonly RUNNING: "running";
+    readonly PAUSED: "paused";
+    readonly WAITING_APPROVAL: "waiting_approval";
+    readonly WAITING_MANUAL: "waiting_manual";
+    readonly COMPLETED: "completed";
+    readonly FAILED: "failed";
+    readonly ROLLED_BACK: "rolled_back";
+    readonly CANCELLED: "cancelled";
+};
+export type ExecutionState = (typeof ExecutionState)[keyof typeof ExecutionState];
+/**
+ * Step execution state
+ */
+export declare const StepState: {
+    readonly PENDING: "pending";
+    readonly QUEUED: "queued";
+    readonly RUNNING: "running";
+    readonly WAITING_APPROVAL: "waiting_approval";
+    readonly COMPLETED: "completed";
+    readonly FAILED: "failed";
+    readonly SKIPPED: "skipped";
+    readonly ROLLED_BACK: "rolled_back";
+    readonly TIMED_OUT: "timed_out";
+};
+export type StepState = (typeof StepState)[keyof typeof StepState];
+/**
+ * Persistent execution state for a playbook run
+ */
+export interface PlaybookExecutionState {
+    /** Unique execution ID */
+    executionId: string;
+    /** Associated incident ID */
+    incidentId: string;
+    /** Playbook ID being executed */
+    playbookId: string;
+    /** Current execution state */
+    state: ExecutionState;
+    /** State of each step */
+    stepStates: Record<string, StepExecutionState>;
+    /** Execution variables/context */
+    variables: Record<string, unknown>;
+    /** When execution started */
+    startedAt: Date;
+    /** When execution was last updated */
+    updatedAt: Date;
+    /** When execution completed (if applicable) */
+    completedAt?: Date;
+    /** Error message if failed */
+    error?: string;
+    /** Steps that have been rolled back */
+    rolledBackSteps: string[];
+    /** Checkpoint for resuming execution */
+    checkpoint?: {
+        stepId: string;
+        position: number;
+    };
+}
+/**
+ * State of a single step execution
+ */
+export interface StepExecutionState {
+    stepId: string;
+    state: StepState;
+    startedAt?: Date;
+    completedAt?: Date;
+    retryCount: number;
+    output?: unknown;
+    error?: string;
+    approvedBy?: string;
+    approvedAt?: Date;
+    rollbackCompleted?: boolean;
+}
+/**
+ * Action context provided to automated actions
+ */
+export interface ActionContext {
+    /** The incident being handled */
+    incident: Incident;
+    /** The playbook being executed */
+    playbook: Playbook;
+    /** The current step being executed */
+    step: PlaybookStep;
+    /** Execution variables */
+    variables: Record<string, unknown>;
+    /** Logger for the action */
+    logger: {
+        debug: (message: string, data?: Record<string, unknown>) => void;
+        info: (message: string, data?: Record<string, unknown>) => void;
+        warn: (message: string, data?: Record<string, unknown>) => void;
+        error: (message: string, data?: Record<string, unknown>) => void;
+    };
+    /** Add evidence to the incident */
+    addEvidence: (evidence: Omit<Evidence, 'id' | 'collectedAt'>) => Promise<Evidence>;
+    /** Update incident */
+    updateIncident: (updates: UpdateIncidentInput) => Promise<void>;
+    /** Set a variable for later steps */
+    setVariable: (key: string, value: unknown) => void;
+    /** Get a variable from a previous step */
+    getVariable: <T = unknown>(key: string) => T | undefined;
+    /** Abort signal for cancellation */
+    abortSignal: AbortSignal;
+}
+/**
+ * Result of executing an automated action
+ */
+export interface ActionResult {
+    /** Whether the action succeeded */
+    success: boolean;
+    /** Output data from the action */
+    output?: unknown;
+    /** Error message if failed */
+    error?: string;
+    /** Metrics about the action */
+    metrics?: {
+        durationMs: number;
+        itemsProcessed?: number;
+        itemsFailed?: number;
+    };
+    /** Whether the action can be rolled back */
+    canRollback?: boolean;
+    /** Data needed for rollback */
+    rollbackData?: unknown;
+}
+/**
+ * Definition of an automated action
+ */
+export interface ActionDefinition {
+    /** Unique action ID */
+    id: string;
+    /** Human-readable name */
+    name: string;
+    /** Description of what the action does */
+    description: string;
+    /** Category of action */
+    category: 'containment' | 'eradication' | 'recovery' | 'notification' | 'evidence' | 'monitoring';
+    /** Risk level of the action */
+    riskLevel: 'low' | 'medium' | 'high' | 'critical';
+    /** Whether the action requires approval by default */
+    requiresApproval: boolean;
+    /** Whether the action supports rollback */
+    supportsRollback: boolean;
+    /** Default timeout in milliseconds */
+    defaultTimeoutMs: number;
+    /** Maximum retry attempts */
+    maxRetries: number;
+    /** Execute the action */
+    execute: (context: ActionContext) => Promise<ActionResult>;
+    /** Rollback the action (if supported) */
+    rollback?: (context: ActionContext, rollbackData: unknown) => Promise<ActionResult>;
+    /** Validate that the action can be executed */
+    validate?: (context: ActionContext) => Promise<{
+        valid: boolean;
+        reason?: string;
+    }>;
+}
+/**
+ * Rollback procedure for a step
+ */
+export interface RollbackProcedure {
+    stepId: string;
+    rollbackSteps: Array<{
+        order: number;
+        description: string;
+        action: (context: ActionContext, rollbackData: unknown) => Promise<void>;
+    }>;
+}
+/**
+ * Alert rule for triggering incidents
+ */
+export interface AlertRule {
+    /** Unique rule ID */
+    id: string;
+    /** Rule name */
+    name: string;
+    /** Whether the rule is enabled */
+    enabled: boolean;
+    /** Conditions that trigger the rule */
+    conditions: AlertCondition[];
+    /** How conditions are combined */
+    conditionOperator: 'and' | 'or';
+    /** Resulting incident configuration */
+    incidentConfig: {
+        type: IncidentType;
+        severity: IncidentSeverity;
+        titleTemplate: string;
+        descriptionTemplate: string;
+        tags?: string[];
+        autoAssignee?: string;
+    };
+    /** Playbook to auto-attach */
+    playbookId?: string;
+    /** Cooldown period to prevent duplicate incidents (in seconds) */
+    cooldownSeconds: number;
+    /** Priority for rule matching (higher = checked first) */
+    priority: number;
+}
+/**
+ * Condition for alert rules
+ */
+export interface AlertCondition {
+    /** Field to evaluate */
+    field: string;
+    /** Operator for comparison */
+    operator: 'equals' | 'not_equals' | 'contains' | 'not_contains' | 'matches' | 'gt' | 'lt' | 'gte' | 'lte' | 'in' | 'not_in' | 'exists' | 'not_exists';
+    /** Value to compare against */
+    value?: unknown;
+}
+/**
+ * Alert from an external system or detector
+ */
+export interface Alert {
+    /** Unique alert ID */
+    alertId: string;
+    /** Alert source (e.g., 'anomaly_detector', 'waf', 'ids') */
+    source: string;
+    /** Alert type/category */
+    type: string;
+    /** Alert severity */
+    severity: 'info' | 'warning' | 'error' | 'critical';
+    /** Alert title/summary */
+    title: string;
+    /** Detailed description */
+    description: string;
+    /** When the alert was generated */
+    timestamp: Date;
+    /** Associated user ID if any */
+    userId?: string;
+    /** Associated IP address if any */
+    ipAddress?: string;
+    /** Associated resource/endpoint if any */
+    resource?: string;
+    /** Raw alert data */
+    rawData: Record<string, unknown>;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * State storage interface for persisting execution state
+ */
+export interface ExecutionStateStore {
+    /** Save execution state */
+    save(state: PlaybookExecutionState): Promise<void>;
+    /** Load execution state */
+    load(executionId: string): Promise<PlaybookExecutionState | null>;
+    /** Load execution state by incident ID */
+    loadByIncident(incidentId: string): Promise<PlaybookExecutionState | null>;
+    /** Delete execution state */
+    delete(executionId: string): Promise<void>;
+    /** List all active executions */
+    listActive(): Promise<PlaybookExecutionState[]>;
+    /** Update specific fields */
+    update(executionId: string, updates: Partial<PlaybookExecutionState>): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map