import { APIResource } from "../../../core/resource.js";
import { APIPromise } from "../../../core/api-promise.js";
import { RequestOptions } from "../../../internal/request-options.js";
export declare class BaseAggregate extends APIResource {
    static readonly _key: readonly ['cloudforceOne', 'threatEvents', 'aggregate'];
    /**
     * Aggregate threat events by one or more columns (e.g., attacker, targetIndustry)
     * with optional date filtering and daily grouping. Supports multi-dimensional
     * aggregation for cross-analysis.
     *
     * @example
     * ```ts
     * const aggregates =
     *   await client.cloudforceOne.threatEvents.aggregate.list({
     *     account_id: 'account_id',
     *     aggregateBy: 'aggregateBy',
     *   });
     * ```
     */
    list(params: AggregateListParams, options?: RequestOptions): APIPromise<AggregateListResponse>;
}
export declare class Aggregate extends BaseAggregate {
}
export interface AggregateListResponse {
    /**
     * Column(s) that were aggregated by
     */
    aggregateBy: string;
    /**
     * Array of aggregation results with dynamic fields based on aggregateBy columns
     */
    aggregations: Array<AggregateListResponse.Aggregation>;
    /**
     * Total number of events in the aggregation
     */
    total: number;
    /**
     * Date range used for filtering
     */
    dateRange?: AggregateListResponse.DateRange;
}
export declare namespace AggregateListResponse {
    interface Aggregation {
        /**
         * Number of events for this aggregation
         */
        count: number;
        /**
         * Date (if groupByDate is true)
         */
        date?: string;
        [k: string]: string | null | number | undefined;
    }
    /**
     * Date range used for filtering
     */
    interface DateRange {
        endDate?: string;
        startDate?: string;
    }
}
export interface AggregateListParams {
    /**
     * Path param: Account ID.
     */
    account_id: string;
    /**
     * Query param: Column(s) to aggregate by - single column or comma-separated list
     * (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry')
     */
    aggregateBy: string;
    /**
     * Query param: Dataset UUIDs to filter by, or one standalone scope value:
     * 'all'/'\*' for all accessible non-analytics event datasets (analytics datasets
     * are silently excluded), 'analytics' for isAnalytics=true datasets, or
     * 'operational' for isAnalytics=false datasets. If not provided, uses the default
     * dataset.
     */
    datasetId?: Array<string>;
    /**
     * Query param: End date for filtering (ISO 8601 format, e.g., '2024-12-31')
     */
    endDate?: string;
    /**
     * Query param: Whether to group results by date (daily aggregation)
     */
    groupByDate?: boolean;
    /**
     * Query param: Maximum number of results to return
     */
    limit?: number;
    /**
     * Query param: Start date for filtering (ISO 8601 format, e.g., '2024-01-01')
     */
    startDate?: string;
}
export declare namespace Aggregate {
    export { type AggregateListResponse as AggregateListResponse, type AggregateListParams as AggregateListParams, };
}
//# sourceMappingURL=aggregate.d.ts.map