@iota-big3/sdk-security/dist/enhanced-security-scanner.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Enhanced Security Scanner
 * Integrates SIEM platforms, vulnerability scanners, and security orchestration
 */
import { Scan, ScanType, SecurityScanner } from './security-scanner';
import { SecurityAction, SIEMConfig, SIEMEvent, ThreatIndicator, VulnerabilityScanResult } from './siem/types';
export interface EnhancedScannerConfig {
    siemConfigs?: SIEMConfig[];
    vulnerabilityScanners?: Array<{
        type: 'QUALYS' | 'NESSUS' | 'RAPID7' | 'OPENVAS';
        enabled: boolean;
        apiEndpoint?: string;
        credentials?: any;
    }>;
    orchestration?: {
        enabled: boolean;
        autoRemediate: boolean;
        playbooks: SecurityPlaybook[];
    };
    threatIntelFeeds?: Array<{
        name: string;
        url: string;
        apiKey?: string;
        refreshInterval: number;
    }>;
    waf?: {
        enabled: boolean;
        provider: 'CLOUDFLARE' | 'AWS_WAF' | 'AZURE_WAF' | 'CUSTOM';
        rules: WAFRule[];
    };
    ddosProtection?: {
        enabled: boolean;
        thresholds: {
            requestsPerSecond: number;
            connectionLimit: number;
            bandwidthLimit: number;
        };
    };
}
export interface SecurityPlaybook {
    id: string;
    name: string;
    trigger: PlaybookTrigger;
    actions: SecurityAction[];
    enabled: boolean;
}
export interface PlaybookTrigger {
    type: 'FINDING' | 'THRESHOLD' | 'PATTERN' | 'SCHEDULE';
    condition: any;
}
export interface WAFRule {
    id: string;
    name: string;
    action: 'BLOCK' | 'ALLOW' | 'CHALLENGE' | 'LOG';
    condition: {
        field: string;
        operator: string;
        value: any;
    };
    priority: number;
}
export interface EnhancedScanResult extends Scan {
    correlatedEvents?: SIEMEvent[];
    vulnerabilityResults?: VulnerabilityScanResult[];
    threatMatches?: ThreatIndicator[];
    actionsExecuted?: SecurityAction[];
    riskScore?: number;
}
export declare class EnhancedSecurityScanner extends SecurityScanner {
    private config;
    private siemConnectors;
    private vulnerabilityScanners;
    private threatIntelFeeds;
    private activePlaybooks;
    private wafRules;
    private ddosMetrics;
    constructor(config?: EnhancedScannerConfig);
    /**
     * Initialize all security components
     */
    private initializeComponents;
    /**
     * Enhanced scan with SIEM correlation and vulnerability scanning
     */
    scan(type: ScanType, target: string, context?: string): Promise<EnhancedScanResult>;
    /**
     * Perform vulnerability scans across all configured scanners
     */
    private performVulnerabilityScans;
    /**
     * Check threat intelligence feeds
     */
    private checkThreatIntelligence;
    /**
     * Calculate overall risk score
     */
    private calculateRiskScore;
    /**
     * Execute security playbooks based on findings
     */
    private executePlaybooks;
    /**
     * WAF request filtering
     */
    filterRequest(request: any): Promise<{
        allowed: boolean;
        rule?: WAFRule;
    }>;
    /**
     * DDoS protection monitoring
     */
    private startDDoSMonitoring;
    /**
     * Send event to all configured SIEM platforms
     */
    private sendToSIEM;
    /**
     * Initialize threat intelligence feed
     */
    private initializeThreatIntelFeed;
    /**
     * Update threat intelligence feed
     */
    private updateThreatIntelFeed;
    /**
     * Helper methods
     */
    private mapFindingsToSIEMSeverity;
    private mapThreatSeverityToSIEM;
    private matchesIndicator;
    private shouldTriggerPlaybook;
    private executeAction;
    private matchesWAFRule;
    private triggerDDoSMitigation;
    /**
     * Update DDoS metrics (would be called by network layer)
     */
    updateDDoSMetrics(metrics: Partial<typeof this.ddosMetrics>): void;
    /**
     * Get current security posture
     */
    getSecurityPosture(): Promise<any>;
    /**
     * Cleanup resources
     */
    dispose(): Promise<void>;
}
//# sourceMappingURL=enhanced-security-scanner.d.ts.map