@iota-big3/sdk-security/dist/incident-response/incident-response-manager.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Incident Response Manager
 * Core incident management and response coordination
 */
import { EventEmitter } from 'events';
import { Action, Artifact, Evidence, ExportFormat, IncidentResponseManager as IIncidentResponseManager, Incident, IncidentFilter, IncidentReport, IncidentSeverity, IncidentStatus, NotificationTemplate, ReportType, ResponderInfo, TimelineEvent } from './types';
interface IncidentManagerConfig {
    storagePath?: string;
    notificationConfig?: NotificationConfig;
    integrations?: IntegrationConfig;
    autoEscalation?: boolean;
    retentionDays?: number;
}
interface NotificationConfig {
    email?: EmailConfig;
    slack?: SlackConfig;
    pagerDuty?: PagerDutyConfig;
    teams?: TeamsConfig;
}
interface EmailConfig {
    smtp: {
        host: string;
        port: number;
        secure: boolean;
        auth: {
            user: string;
            pass: string;
        };
    };
    from: string;
}
interface SlackConfig {
    webhookUrl: string;
    channel?: string;
}
interface PagerDutyConfig {
    apiKey: string;
    serviceId: string;
}
interface TeamsConfig {
    webhookUrl: string;
}
interface IntegrationConfig {
    siem?: {
        platform: string;
        endpoint: string;
        apiKey: string;
    };
    ticketing?: {
        system: string;
        endpoint: string;
        apiKey: string;
    };
}
export declare class IncidentResponseManager extends EventEmitter implements IIncidentResponseManager {
    private config;
    private incidents;
    private activePlaybooks;
    private responderTeams;
    private notificationQueue;
    private isInitialized;
    constructor(config?: IncidentManagerConfig);
    /**
     * Initialize the incident response manager
     */
    initialize(): Promise<void>;
    /**
     * Create a new incident
     */
    createIncident(incidentData: Partial<Incident>): Promise<Incident>;
    /**
     * Update an existing incident
     */
    updateIncident(id: string, updates: Partial<Incident>): Promise<Incident>;
    /**
     * Get incident by ID
     */
    getIncident(id: string): Promise<Incident>;
    /**
     * List incidents with optional filtering
     */
    listIncidents(filter?: IncidentFilter): Promise<Incident[]>;
    /**
     * Triage an incident
     */
    triageIncident(id: string, severity: IncidentSeverity): Promise<void>;
    /**
     * Update incident status
     */
    updateStatus(id: string, status: IncidentStatus): Promise<void>;
    /**
     * Resolve an incident
     */
    resolveIncident(id: string, resolution: string): Promise<void>;
    /**
     * Close an incident
     */
    closeIncident(id: string, report?: IncidentReport): Promise<void>;
    /**
     * Assign incident to responder
     */
    assignIncident(id: string, responder: ResponderInfo): Promise<void>;
    /**
     * Add responder to team
     */
    addResponder(id: string, responder: ResponderInfo): Promise<void>;
    /**
     * Remove responder from team
     */
    removeResponder(id: string, responderId: string): Promise<void>;
    /**
     * Escalate incident
     */
    escalateIncident(id: string, reason?: string): Promise<void>;
    /**
     * Add evidence
     */
    addEvidence(id: string, evidence: Evidence): Promise<void>;
    /**
     * Add artifact
     */
    addArtifact(id: string, file: File): Promise<Artifact>;
    /**
     * Get evidence
     */
    getEvidence(id: string, evidenceId: string): Promise<Evidence>;
    /**
     * Add timeline event
     */
    addTimelineEvent(id: string, event: TimelineEvent): Promise<void>;
    /**
     * Get timeline
     */
    getTimeline(id: string): Promise<TimelineEvent[]>;
    /**
     * Execute action
     */
    executeAction(id: string, action: Action): Promise<void>;
    /**
     * Execute playbook
     */
    executePlaybook(id: string, playbookId: string): Promise<void>;
    /**
     * Rollback action
     */
    rollbackAction(id: string, actionId: string): Promise<void>;
    /**
     * Notify responders
     */
    notifyResponders(id: string, template: NotificationTemplate): Promise<void>;
    /**
     * Broadcast update
     */
    broadcastUpdate(id: string, message: string): Promise<void>;
    /**
     * Generate report
     */
    generateReport(id: string, type: ReportType): Promise<IncidentReport>;
    /**
     * Export incident
     */
    exportIncident(id: string, format: ExportFormat): Promise<Buffer>;
    /**
     * Private helper methods
     */
    private generateIncidentId;
    private assessInitialImpact;
    private autoAssignResponders;
    private checkEscalationCriteria;
    private performAction;
    private performRollback;
    private executePlaybookStep;
    private evaluateConditions;
    private sendIncidentNotification;
    private sendEscalationNotifications;
    private notifyResponder;
    private sendNotification;
    private processTemplate;
    private calculateMetrics;
    private generateSummary;
    private generateExecutiveSummary;
    private generateTechnicalReport;
    private generateComplianceReport;
    private extractLessonsLearned;
    private generateRecommendations;
    private calculateFileHash;
    private formatFileSize;
    private queueArtifactScan;
    private pushToSIEM;
    private loadIncidents;
    private initializeNotifications;
    private startBackgroundProcesses;
    private processNotificationQueue;
    private checkAutoEscalations;
    private cleanupOldIncidents;
    private exportToCSV;
    private exportToHTML;
}
export {};
//# sourceMappingURL=incident-response-manager.d.ts.map