import { APIResource } from "../../../../core/resource.js";
import { APIPromise } from "../../../../core/api-promise.js";
import { RequestOptions } from "../../../../internal/request-options.js";
export declare class BaseAggregate extends APIResource {
    static readonly _key: readonly ['cloudforceOne', 'threatEvents', 'indicators', 'aggregate'];
    /**
     * Aggregate threat indicators by one or more columns (e.g., indicatorType, value)
     * across datasets. Returns top-N groups ordered by count.
     *
     * @example
     * ```ts
     * const aggregates =
     *   await client.cloudforceOne.threatEvents.indicators.aggregate.list(
     *     {
     *       account_id: 'account_id',
     *       aggregateBy: 'aggregateBy',
     *     },
     *   );
     * ```
     */
    list(params: AggregateListParams, options?: RequestOptions): APIPromise<AggregateListResponse>;
}
export declare class Aggregate extends BaseAggregate {
}
export interface AggregateListResponse {
    /**
     * Column(s) that were aggregated by
     */
    aggregateBy: string;
    /**
     * Array of aggregation results with dynamic fields based on aggregateBy columns
     */
    aggregations: Array<AggregateListResponse.Aggregation>;
    /**
     * Number of datasets whose aggregation failed and were excluded from the result
     */
    failedDatasets: number;
    /**
     * Total count in the aggregation: indicator rows when measure=indicators, or
     * linked-event rows when measure=relationships
     */
    total: number;
}
export declare namespace AggregateListResponse {
    interface Aggregation {
        /**
         * Number of indicators for this aggregation
         */
        count: number;
        [k: string]: string | null | number | undefined;
    }
}
export interface AggregateListParams {
    /**
     * Path param: Account ID.
     */
    account_id: string;
    /**
     * Query param: Column(s) to aggregate by - single column or comma-separated list
     * (e.g., 'indicatorType', 'value', 'indicatorType,value')
     */
    aggregateBy: string;
    /**
     * Query param: Filter indicators created after this date/datetime (ISO 8601, e.g.,
     * '2024-01-01' or '2024-01-01T00:00:00Z')
     */
    createdAfter?: (string & {}) | string;
    /**
     * Query param: Filter indicators created before this date/datetime (ISO 8601,
     * e.g., '2024-12-31' or '2024-12-31T23:59:59Z')
     */
    createdBefore?: (string & {}) | string;
    /**
     * Query param: Dataset UUIDs to filter by, or one standalone scope value:
     * 'all'/'\*' for all accessible datasets, 'analytics' for isAnalytics=true
     * datasets, or 'operational' for isAnalytics=false datasets. If not provided,
     * aggregates across all accessible datasets.
     */
    datasetIds?: Array<string>;
    /**
     * Query param: For measure=relationships: only count indicator→event links whose
     * relationship was created/observed on or after this date (ISO 8601). Bounds the
     * activity view to recently-observed links. Note: this filters by the
     * relationship's createdAt (link-observation time), not the underlying event's
     * business date.
     */
    eventDateAfter?: string;
    /**
     * Query param: For measure=relationships: only count indicator→event links whose
     * relationship was created/observed on or before this date (ISO 8601). Bounds the
     * activity view by the relationship's createdAt (link-observation time), not the
     * underlying event's business date.
     */
    eventDateBefore?: string;
    /**
     * Query param: Maximum number of aggregation results to return (1-100)
     */
    limit?: number;
    /**
     * Query param: What to count per group: 'indicators' (catalog rows, default) or
     * 'relationships' (linked events per indicator). Use 'relationships' for 'top
     * indicator by event activity'.
     */
    measure?: 'indicators' | 'relationships';
    /**
     * Query param: Scope to indicators associated with this tag/actor UUID. Combine
     * with measure=relationships for 'top indicator for an actor'.
     */
    tagUuid?: string;
}
export declare namespace Aggregate {
    export { type AggregateListResponse as AggregateListResponse, type AggregateListParams as AggregateListParams, };
}
//# sourceMappingURL=aggregate.d.ts.map