export interface XdrThreat {
    id: string;
    threatType: 'suspicious_process' | 'suspicious_connection' | 'suspicious_service' | 'suspicious_script' | 'privilege_escalation' | 'data_exfiltration';
    category: 'malware' | 'pua' | 'network' | 'persistence' | 'lateral_movement' | 'exfiltration' | 'anomaly';
    severity: 'critical' | 'high' | 'medium' | 'low';
    threatScore: number;
    description: string;
    indicators: string[];
    processName?: string;
    processPid?: number;
    processPath?: string;
    processCmdline?: string;
    processHash?: string;
    processParent?: string;
    connectionRemoteIp?: string;
    connectionRemotePort?: number;
    connectionProto?: string;
    serviceName?: string;
    scriptPath?: string;
    scriptContentPreview?: string;
    mlFeatures?: Record<string, number>;
    rawData?: any;
}
export interface XdrScanResult {
    scanId: string;
    agentId?: string;
    threats: XdrThreat[];
    summary: {
        processesScanned: number;
        connectionsScanned: number;
        servicesScanned: number;
        scriptsScanned: number;
        criticalThreats: number;
        highThreats: number;
        mediumThreats: number;
        lowThreats: number;
        scanDuration: number;
    };
    existingAvDetected?: string[];
    error?: string;
}
export declare class XdrScanner {
    private scanning;
    private isWindows;
    private isLinux;
    private isMac;
    scan(scanId: string, onProgress?: (p: number) => void): Promise<XdrScanResult>;
    private emptyResult;
    private collectProcesses;
    private parseWmicProcesses;
    private parsePsProcesses;
    private collectConnections;
    private parseNetstatWindows;
    private parseNetstatLinux;
    private collectServices;
    private parseScServices;
    private parseSystemdServices;
    private parseLaunchctlServices;
    private collectPersistenceScripts;
    private detectExistingAv;
    private analyseProcesses;
    private extractProcessMlFeatures;
    private analyseConnections;
    private isKnownGoodProcess;
    private analyseServices;
    private analyseScripts;
    blockProcess(pid: number, processName: string): Promise<{
        success: boolean;
        message: string;
    }>;
    blockConnection(remoteIp: string, remotePort: number): Promise<{
        success: boolean;
        message: string;
    }>;
    unblockConnection(remoteIp: string, remotePort: number): Promise<{
        success: boolean;
        message: string;
    }>;
}
//# sourceMappingURL=xdr-scanner.d.ts.map