@iota-big3/sdk-security/dist/incident-response/automated-detector.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Automated Incident Detector
 * Monitors security events and automatically creates incidents
 */
import { EventEmitter } from 'events';
import { SIEMAlert } from '../siem/types';
import { SecurityEvent, ThreatIndicator } from '../types';
import { IncidentResponseManager } from './incident-response-manager';
import { IncidentSeverity, IncidentType } from './types';
interface DetectionRule {
    id: string;
    name: string;
    description: string;
    enabled: boolean;
    conditions: RuleCondition[];
    incidentConfig: {
        type: IncidentType;
        severity: IncidentSeverity;
        titleTemplate: string;
        descriptionTemplate: string;
        tags: string[];
    };
    correlation?: {
        timeWindow: number;
        minEvents: number;
        groupBy?: string[];
    };
}
interface RuleCondition {
    field: string;
    operator: 'equals' | 'contains' | 'greater' | 'less' | 'matches' | 'in';
    value: any;
    logic?: 'AND' | 'OR';
}
export declare class AutomatedIncidentDetector extends EventEmitter {
    private irManager;
    private rules;
    private correlationWindows;
    private eventBuffer;
    private isRunning;
    private processInterval?;
    constructor(irManager: IncidentResponseManager);
    /**
     * Start the detector
     */
    start(): void;
    /**
     * Stop the detector
     */
    stop(): void;
    /**
     * Process security event
     */
    processSecurityEvent(event: SecurityEvent): Promise<void>;
    /**
     * Process SIEM alert
     */
    processSIEMAlert(alert: SIEMAlert): Promise<void>;
    /**
     * Process threat indicator match
     */
    processThreatIndicator(indicator: ThreatIndicator, context: any): Promise<void>;
    /**
     * Add detection rule
     */
    addRule(rule: DetectionRule): void;
    /**
     * Remove detection rule
     */
    removeRule(ruleId: string): void;
    /**
     * Get all rules
     */
    getRules(): DetectionRule[];
    /**
     * Private methods
     */
    private initializeDefaultRules;
    private processEventBuffer;
    private evaluateRules;
    private matchesConditions;
    private getFieldValue;
    private evaluateCondition;
    private addToCorrelation;
    private getCorrelationGroupKey;
    private checkCorrelations;
    private createIncidentFromRule;
    private createIncidentFromSIEMAlert;
    private extractContext;
    private processTemplate;
    private isHighPriority;
    private mapIndicatorToIncidentType;
    private calculateSeverityFromThreatScore;
    private mapSIEMSeverity;
    private mapSIEMAlertType;
}
export {};
//# sourceMappingURL=automated-detector.d.ts.map