@iota-big3/sdk-security/dist/automation/security-orchestrator.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Security Orchestration, Automation and Response (SOAR)
 * Automates security workflows and incident response
 */
import { EventEmitter } from 'events';
import { ThreatEvent } from '../threat-detection/ml-threat-detector';
export interface SecurityPlaybook {
    id: string;
    name: string;
    description: string;
    triggers: PlaybookTrigger[];
    actions: PlaybookAction[];
    conditions?: PlaybookCondition[];
    enabled: boolean;
}
export interface PlaybookTrigger {
    type: 'threat' | 'alert' | 'schedule' | 'manual';
    criteria: Record<string, any>;
}
export interface PlaybookAction {
    id: string;
    type: ActionType;
    parameters: Record<string, any>;
    order: number;
    continueOnError?: boolean;
}
export interface PlaybookCondition {
    field: string;
    operator: 'equals' | 'contains' | 'greater' | 'less';
    value: any;
}
export declare enum ActionType {
    BLOCK_IP = "block_ip",
    ISOLATE_USER = "isolate_user",
    ROTATE_CREDENTIALS = "rotate_credentials",
    SCALE_INFRASTRUCTURE = "scale_infrastructure",
    NOTIFY_TEAM = "notify_team",
    CREATE_TICKET = "create_ticket",
    COLLECT_FORENSICS = "collect_forensics",
    APPLY_PATCH = "apply_patch",
    UPDATE_RULES = "update_rules",
    QUARANTINE_FILE = "quarantine_file"
}
export interface IncidentResponse {
    incidentId: string;
    threatEvent: ThreatEvent;
    playbook: SecurityPlaybook;
    actions: ActionResult[];
    startTime: Date;
    endTime: Date;
    status: 'success' | 'partial' | 'failed';
}
export interface ActionResult {
    actionId: string;
    type: ActionType;
    status: 'success' | 'failed' | 'skipped';
    message?: string;
    executedAt: Date;
}
export declare class SecurityOrchestrator extends EventEmitter {
    private playbooks;
    private activeIncidents;
    private actionHandlers;
    constructor();
    /**
     * Register a security playbook
     */
    registerPlaybook(): void;
    /**
     * Handle threat event with automated response
     */
    handleThreatEvent(threat: ThreatEvent): Promise<IncidentResponse[]>;
    /**
     * Execute a security playbook
     */
    private executePlaybook;
    /**
     * Execute a single action
     */
    private executeAction;
    /**
     * Initialize default security playbooks
     */
    private initializeDefaultPlaybooks;
}
//# sourceMappingURL=security-orchestrator.d.ts.map