@iota-big3/sdk-security/dist/incident-response/types.d.ts

Advanced security features including zero trust, quantum-safe crypto, and ML threat detection

/**
 * Incident Response Types
 * Enterprise-grade incident management and response workflows
 */
/**
 * Incident severity levels
 */
export declare enum IncidentSeverity {
    CRITICAL = "CRITICAL",// P1 - Business critical, immediate response
    HIGH = "HIGH",// P2 - Major impact, rapid response
    MEDIUM = "MEDIUM",// P3 - Moderate impact, standard response
    LOW = "LOW",// P4 - Minor impact, scheduled response
    INFO = "INFO"
}
/**
 * Incident status
 */
export declare enum IncidentStatus {
    DETECTED = "DETECTED",// Initial detection
    TRIAGED = "TRIAGED",// Severity assessed
    INVESTIGATING = "INVESTIGATING",// Active investigation
    CONTAINED = "CONTAINED",// Threat contained
    ERADICATING = "ERADICATING",// Removing threat
    RECOVERING = "RECOVERING",// Restoring services
    RESOLVED = "RESOLVED",// Incident resolved
    CLOSED = "CLOSED",// Post-incident complete
    FALSE_POSITIVE = "FALSE_POSITIVE"
}
/**
 * Incident types
 */
export declare enum IncidentType {
    MALWARE = "MALWARE",
    RANSOMWARE = "RANSOMWARE",
    DATA_BREACH = "DATA_BREACH",
    UNAUTHORIZED_ACCESS = "UNAUTHORIZED_ACCESS",
    DENIAL_OF_SERVICE = "DENIAL_OF_SERVICE",
    INSIDER_THREAT = "INSIDER_THREAT",
    PHISHING = "PHISHING",
    SUPPLY_CHAIN = "SUPPLY_CHAIN",
    ZERO_DAY = "ZERO_DAY",
    COMPLIANCE_VIOLATION = "COMPLIANCE_VIOLATION",
    MISCONFIGURATION = "MISCONFIGURATION",
    OTHER = "OTHER"
}
/**
 * Incident source
 */
export declare enum IncidentSource {
    SIEM = "SIEM",
    IDS_IPS = "IDS_IPS",
    EDR = "EDR",
    FIREWALL = "FIREWALL",
    USER_REPORT = "USER_REPORT",
    THREAT_INTEL = "THREAT_INTEL",
    VULNERABILITY_SCAN = "VULNERABILITY_SCAN",
    LOG_ANALYSIS = "LOG_ANALYSIS",
    AUTOMATED_DETECTION = "AUTOMATED_DETECTION",
    EXTERNAL_REPORT = "EXTERNAL_REPORT"
}
/**
 * Core incident interface
 */
export interface Incident {
    id: string;
    title: string;
    description: string;
    type: IncidentType;
    severity: IncidentSeverity;
    status: IncidentStatus;
    source: IncidentSource;
    detectedAt: Date;
    triageStartedAt?: Date;
    containedAt?: Date;
    resolvedAt?: Date;
    closedAt?: Date;
    affectedSystems: string[];
    affectedUsers: string[];
    affectedData?: string[];
    businessImpact: BusinessImpact;
    assignedTo?: ResponderInfo;
    responseTeam: ResponderInfo[];
    escalationPath?: EscalationPath;
    evidence: Evidence[];
    artifacts: Artifact[];
    timeline: TimelineEvent[];
    containmentActions: Action[];
    eradicationActions: Action[];
    recoveryActions: Action[];
    relatedIncidents?: string[];
    parentIncident?: string;
    childIncidents?: string[];
    tags: string[];
    customFields?: Record<string, any>;
    compliance?: ComplianceInfo;
}
/**
 * Business impact assessment
 */
export interface BusinessImpact {
    confidentiality: ImpactLevel;
    integrity: ImpactLevel;
    availability: ImpactLevel;
    financial?: number;
    reputational?: ImpactLevel;
    regulatory?: boolean;
    dataLoss?: boolean;
    customersAffected?: number;
}
export declare enum ImpactLevel {
    NONE = "NONE",
    LOW = "LOW",
    MEDIUM = "MEDIUM",
    HIGH = "HIGH",
    CRITICAL = "CRITICAL"
}
/**
 * Responder information
 */
export interface ResponderInfo {
    id: string;
    name: string;
    role: ResponderRole;
    contactInfo: ContactInfo;
    availability?: AvailabilityStatus;
    skills?: string[];
}
export declare enum ResponderRole {
    INCIDENT_COMMANDER = "INCIDENT_COMMANDER",
    SECURITY_ANALYST = "SECURITY_ANALYST",
    FORENSICS_EXPERT = "FORENSICS_EXPERT",
    NETWORK_ENGINEER = "NETWORK_ENGINEER",
    SYSTEM_ADMIN = "SYSTEM_ADMIN",
    LEGAL_COUNSEL = "LEGAL_COUNSEL",
    PR_COMMUNICATIONS = "PR_COMMUNICATIONS",
    EXECUTIVE = "EXECUTIVE",
    EXTERNAL_CONSULTANT = "EXTERNAL_CONSULTANT"
}
export interface ContactInfo {
    email: string;
    phone?: string;
    slack?: string;
    pagerDuty?: string;
}
export declare enum AvailabilityStatus {
    AVAILABLE = "AVAILABLE",
    BUSY = "BUSY",
    OFF_DUTY = "OFF_DUTY",
    ON_VACATION = "ON_VACATION"
}
/**
 * Escalation path
 */
export interface EscalationPath {
    levels: EscalationLevel[];
    currentLevel: number;
    autoEscalate: boolean;
    escalationDelay: number;
}
export interface EscalationLevel {
    level: number;
    responders: ResponderInfo[];
    notificationMethods: NotificationMethod[];
    criteria?: EscalationCriteria;
}
export interface EscalationCriteria {
    timeElapsed?: number;
    severity?: IncidentSeverity;
    businessImpact?: ImpactLevel;
    customCondition?: string;
}
/**
 * Evidence and artifacts
 */
export interface Evidence {
    id: string;
    type: EvidenceType;
    title: string;
    description?: string;
    collectedAt: Date;
    collectedBy: string;
    source: string;
    hash?: string;
    size?: number;
    location: string;
    chainOfCustody: CustodyRecord[];
    analysis?: AnalysisResult;
}
export declare enum EvidenceType {
    LOG_FILE = "LOG_FILE",
    MEMORY_DUMP = "MEMORY_DUMP",
    DISK_IMAGE = "DISK_IMAGE",
    NETWORK_CAPTURE = "NETWORK_CAPTURE",
    SCREENSHOT = "SCREENSHOT",
    MALWARE_SAMPLE = "MALWARE_SAMPLE",
    CONFIGURATION = "CONFIGURATION",
    EMAIL = "EMAIL",
    DOCUMENT = "DOCUMENT",
    OTHER = "OTHER"
}
export interface CustodyRecord {
    timestamp: Date;
    custodian: string;
    action: string;
    location: string;
    notes?: string;
}
export interface AnalysisResult {
    analyzedAt: Date;
    analyzedBy: string;
    findings: string;
    iocs?: IOC[];
    recommendations?: string[];
}
export interface IOC {
    type: IOCType;
    value: string;
    confidence: number;
    source: string;
    firstSeen?: Date;
    lastSeen?: Date;
}
export declare enum IOCType {
    IP_ADDRESS = "IP_ADDRESS",
    DOMAIN = "DOMAIN",
    URL = "URL",
    FILE_HASH = "FILE_HASH",
    EMAIL_ADDRESS = "EMAIL_ADDRESS",
    REGISTRY_KEY = "REGISTRY_KEY",
    MUTEX = "MUTEX",
    USER_AGENT = "USER_AGENT"
}
/**
 * Artifacts
 */
export interface Artifact {
    id: string;
    name: string;
    type: string;
    mimeType?: string;
    size: number;
    hash: string;
    uploadedAt: Date;
    uploadedBy: string;
    scanStatus?: ScanStatus;
    metadata?: Record<string, any>;
}
export interface ScanStatus {
    scanned: boolean;
    scanDate?: Date;
    malicious: boolean;
    threats?: string[];
    scanEngine?: string;
}
/**
 * Timeline events
 */
export interface TimelineEvent {
    timestamp: Date;
    type: TimelineEventType;
    title: string;
    description: string;
    actor?: string;
    source?: string;
    severity?: IncidentSeverity;
    evidence?: string[];
    automated?: boolean;
}
export declare enum TimelineEventType {
    DETECTION = "DETECTION",
    ALERT = "ALERT",
    TRIAGE = "TRIAGE",
    ESCALATION = "ESCALATION",
    CONTAINMENT = "CONTAINMENT",
    ERADICATION = "ERADICATION",
    RECOVERY = "RECOVERY",
    COMMUNICATION = "COMMUNICATION",
    EVIDENCE_COLLECTED = "EVIDENCE_COLLECTED",
    ACTION_TAKEN = "ACTION_TAKEN",
    STATUS_CHANGE = "STATUS_CHANGE",
    NOTE = "NOTE"
}
/**
 * Actions
 */
export interface Action {
    id: string;
    type: ActionType;
    title: string;
    description: string;
    executedAt: Date;
    executedBy: string;
    status: ActionStatus;
    result?: string;
    automated?: boolean;
    playbook?: string;
    rollbackable?: boolean;
    rollbackAction?: string;
}
export declare enum ActionType {
    ISOLATE_SYSTEM = "ISOLATE_SYSTEM",
    BLOCK_IP = "BLOCK_IP",
    DISABLE_ACCOUNT = "DISABLE_ACCOUNT",
    RESET_PASSWORD = "RESET_PASSWORD",
    PATCH_SYSTEM = "PATCH_SYSTEM",
    RESTORE_BACKUP = "RESTORE_BACKUP",
    UPDATE_FIREWALL = "UPDATE_FIREWALL",
    QUARANTINE_FILE = "QUARANTINE_FILE",
    COLLECT_LOGS = "COLLECT_LOGS",
    NOTIFY_TEAM = "NOTIFY_TEAM",
    CUSTOM = "CUSTOM"
}
export declare enum ActionStatus {
    PENDING = "PENDING",
    IN_PROGRESS = "IN_PROGRESS",
    COMPLETED = "COMPLETED",
    FAILED = "FAILED",
    ROLLED_BACK = "ROLLED_BACK"
}
/**
 * Playbooks
 */
export interface Playbook {
    id: string;
    name: string;
    description: string;
    type: IncidentType;
    severity?: IncidentSeverity;
    version: string;
    author: string;
    approved: boolean;
    approvedBy?: string;
    approvedAt?: Date;
    phases: PlaybookPhase[];
    automated: boolean;
    requiresApproval?: boolean;
    estimatedDuration?: number;
    tags: string[];
    compliance?: string[];
    lastUsed?: Date;
    successRate?: number;
}
export interface PlaybookPhase {
    name: string;
    order: number;
    steps: PlaybookStep[];
    requiredRole?: ResponderRole;
    estimatedDuration?: number;
}
export interface PlaybookStep {
    id: string;
    title: string;
    description: string;
    action: ActionType;
    parameters?: Record<string, any>;
    conditions?: StepCondition[];
    automated: boolean;
    requiresApproval?: boolean;
    timeout?: number;
    onSuccess?: string;
    onFailure?: string;
}
export interface StepCondition {
    field: string;
    operator: 'equals' | 'contains' | 'greater' | 'less' | 'regex';
    value: any;
}
/**
 * Notifications
 */
export interface NotificationTemplate {
    id: string;
    name: string;
    type: NotificationType;
    subject: string;
    body: string;
    variables: string[];
    attachments?: string[];
}
export declare enum NotificationType {
    INCIDENT_CREATED = "INCIDENT_CREATED",
    STATUS_CHANGED = "STATUS_CHANGED",
    ESCALATION = "ESCALATION",
    ASSIGNMENT = "ASSIGNMENT",
    RESOLUTION = "RESOLUTION",
    CUSTOM = "CUSTOM"
}
export declare enum NotificationMethod {
    EMAIL = "EMAIL",
    SMS = "SMS",
    SLACK = "SLACK",
    TEAMS = "TEAMS",
    PAGERDUTY = "PAGERDUTY",
    WEBHOOK = "WEBHOOK",
    PHONE_CALL = "PHONE_CALL"
}
/**
 * Compliance
 */
export interface ComplianceInfo {
    frameworks: string[];
    reportingRequired: boolean;
    reportingDeadline?: Date;
    regulatoryNotification?: RegulatoryNotification;
    dataProtection?: DataProtectionInfo;
}
export interface RegulatoryNotification {
    required: boolean;
    deadline: Date;
    authorities: string[];
    submitted?: boolean;
    submittedAt?: Date;
    reference?: string;
}
export interface DataProtectionInfo {
    personalDataInvolved: boolean;
    dataTypes?: string[];
    subjectsAffected?: number;
    gdprRelevant?: boolean;
    breachNotification?: boolean;
}
/**
 * Incident Response Manager Interface
 */
export interface IncidentResponseManager {
    createIncident(incident: Partial<Incident>): Promise<Incident>;
    updateIncident(id: string, updates: Partial<Incident>): Promise<Incident>;
    getIncident(id: string): Promise<Incident>;
    listIncidents(filter?: IncidentFilter): Promise<Incident[]>;
    triageIncident(id: string, severity: IncidentSeverity): Promise<void>;
    updateStatus(id: string, status: IncidentStatus): Promise<void>;
    resolveIncident(id: string, resolution: string): Promise<void>;
    closeIncident(id: string, report?: IncidentReport): Promise<void>;
    assignIncident(id: string, responder: ResponderInfo): Promise<void>;
    addResponder(id: string, responder: ResponderInfo): Promise<void>;
    removeResponder(id: string, responderId: string): Promise<void>;
    escalateIncident(id: string, reason?: string): Promise<void>;
    addEvidence(id: string, evidence: Evidence): Promise<void>;
    addArtifact(id: string, artifact: File): Promise<Artifact>;
    getEvidence(id: string, evidenceId: string): Promise<Evidence>;
    addTimelineEvent(id: string, event: TimelineEvent): Promise<void>;
    getTimeline(id: string): Promise<TimelineEvent[]>;
    executeAction(id: string, action: Action): Promise<void>;
    executePlaybook(id: string, playbookId: string): Promise<void>;
    rollbackAction(id: string, actionId: string): Promise<void>;
    notifyResponders(id: string, template: NotificationTemplate): Promise<void>;
    broadcastUpdate(id: string, message: string): Promise<void>;
    generateReport(id: string, type: ReportType): Promise<IncidentReport>;
    exportIncident(id: string, format: ExportFormat): Promise<Buffer>;
}
/**
 * Filters and queries
 */
export interface IncidentFilter {
    status?: IncidentStatus[];
    severity?: IncidentSeverity[];
    type?: IncidentType[];
    assignedTo?: string;
    dateRange?: {
        start: Date;
        end: Date;
    };
    tags?: string[];
    searchTerm?: string;
}
/**
 * Reports
 */
export interface IncidentReport {
    incident: Incident;
    summary: string;
    timeline: TimelineEvent[];
    actionsTable: Action[];
    evidenceSummary: Evidence[];
    lessonsLearned?: string[];
    recommendations?: string[];
    metrics: IncidentMetrics;
    generatedAt: Date;
    generatedBy: string;
}
export interface IncidentMetrics {
    timeToDetect: number;
    timeToContain?: number;
    timeToResolve?: number;
    totalDuration: number;
    affectedSystemsCount: number;
    affectedUsersCount: number;
    actionsExecuted: number;
    evidenceCollected: number;
}
export declare enum ReportType {
    EXECUTIVE_SUMMARY = "EXECUTIVE_SUMMARY",
    TECHNICAL_REPORT = "TECHNICAL_REPORT",
    COMPLIANCE_REPORT = "COMPLIANCE_REPORT",
    LESSONS_LEARNED = "LESSONS_LEARNED",
    FULL_REPORT = "FULL_REPORT"
}
export declare enum ExportFormat {
    PDF = "PDF",
    DOCX = "DOCX",
    JSON = "JSON",
    CSV = "CSV",
    HTML = "HTML"
}
//# sourceMappingURL=types.d.ts.map