"""
WIA Security SDK - Python
Main entry point
"""

from .types import (
    EventType,
    SourceType,
    Priority,
    Direction,
    CloudProvider,
    AlertCategory,
    AlertStatus,
    ThreatType,
    ThreatStatus,
    CvssSeverity,
    IncidentCategory,
    IncidentStatus,
    ImpactLevel,
    NetworkEventType,
    NetworkProtocol,
    NetworkAction,
    EndpointEventType,
    AuthEventType,
    AuthResult,
    AuthMethod,
    Source,
    Host,
    User,
    Cloud,
    Context,
    Mitre,
    Meta,
    Indicator,
    AlertData,
    ThreatIntelData,
    VulnerabilityData,
    IncidentData,
    NetworkEventData,
    EndpointEventData,
    AuthEventData,
    WiaSecurityEvent,
)

from .validator import (
    ValidationResult,
    validate_event,
    is_alert_event,
    is_threat_intel_event,
    is_vulnerability_event,
    is_incident_event,
    is_network_event,
    is_endpoint_event,
    is_auth_event,
)

from .builder import (
    EventBuilder,
    AlertBuilder,
    ThreatIntelBuilder,
    VulnerabilityBuilder,
    IncidentBuilder,
    NetworkEventBuilder,
    EndpointEventBuilder,
    AuthEventBuilder,
    create_alert,
    create_threat_intel,
    create_vulnerability,
    create_incident,
    create_network_event,
    create_endpoint_event,
    create_auth_event,
)

from .converter import (
    to_stix_bundle,
    to_stix_indicator,
    to_ecs_event,
    to_ocsf_event,
    to_splunk_event,
    to_elastic_event,
)

from .client import SecurityClient, SecurityClientConfig, create_client

# Protocol (Phase 3)
from .protocol import (
    WebSocketConfig,
    WebSocketMessage,
    SubscriptionFilter,
    WiaWebSocketClient,
    create_websocket_client,
    TaxiiConfig,
    TaxiiDiscovery,
    TaxiiApiRoot,
    TaxiiCollection,
    TaxiiStatus,
    TaxiiManifestEntry,
    TaxiiClient,
    create_taxii_client,
    SplunkConfig,
    SplunkAdapter,
    ElasticConfig,
    ElasticAdapter,
    QRadarConfig,
    QRadarAdapter,
    create_splunk_adapter,
    create_elastic_adapter,
    create_qradar_adapter,
)

# Integration (Phase 4)
from .integration import (
    ThreatIntelFeedConfig,
    IoC,
    ThreatFeed,
    MispConfig,
    MispClient,
    OtxConfig,
    OtxClient,
    VirusTotalConfig,
    VirusTotalClient,
    create_misp_client,
    create_otx_client,
    create_virustotal_client,
    SoarConfig,
    PlaybookAction,
    Playbook,
    SoarCase,
    Artifact,
    PhantomConfig,
    PhantomClient,
    XsoarConfig,
    XsoarClient,
    ShuffleConfig,
    ShuffleClient,
    create_phantom_client,
    create_xsoar_client,
    create_shuffle_client,
    CloudSecurityConfig,
    CloudFinding,
    AwsSecurityHubConfig,
    AwsSecurityHubClient,
    AzureSentinelConfig,
    AzureSentinelClient,
    GcpSccConfig,
    GcpSccClient,
    create_aws_security_hub_client,
    create_azure_sentinel_client,
    create_gcp_scc_client,
    DashboardMetrics,
    SeverityDistribution,
    TimeSeriesPoint,
    TacticCount,
    TechniqueCount,
    AlertStats,
    ThreatLandscape,
    ComplianceStatus,
    ControlStatus,
    DashboardAggregator,
    ComplianceTracker,
    create_dashboard_aggregator,
    create_compliance_tracker,
)

__version__ = "1.0.0"
__all__ = [
    # Types
    "EventType",
    "SourceType",
    "Priority",
    "Direction",
    "CloudProvider",
    "AlertCategory",
    "AlertStatus",
    "ThreatType",
    "ThreatStatus",
    "CvssSeverity",
    "IncidentCategory",
    "IncidentStatus",
    "ImpactLevel",
    "NetworkEventType",
    "NetworkProtocol",
    "NetworkAction",
    "EndpointEventType",
    "AuthEventType",
    "AuthResult",
    "AuthMethod",
    "Source",
    "Host",
    "User",
    "Cloud",
    "Context",
    "Mitre",
    "Meta",
    "Indicator",
    "AlertData",
    "ThreatIntelData",
    "VulnerabilityData",
    "IncidentData",
    "NetworkEventData",
    "EndpointEventData",
    "AuthEventData",
    "WiaSecurityEvent",
    # Validator
    "ValidationResult",
    "validate_event",
    "is_alert_event",
    "is_threat_intel_event",
    "is_vulnerability_event",
    "is_incident_event",
    "is_network_event",
    "is_endpoint_event",
    "is_auth_event",
    # Builder
    "EventBuilder",
    "AlertBuilder",
    "ThreatIntelBuilder",
    "VulnerabilityBuilder",
    "IncidentBuilder",
    "NetworkEventBuilder",
    "EndpointEventBuilder",
    "AuthEventBuilder",
    "create_alert",
    "create_threat_intel",
    "create_vulnerability",
    "create_incident",
    "create_network_event",
    "create_endpoint_event",
    "create_auth_event",
    # Converter
    "to_stix_bundle",
    "to_stix_indicator",
    "to_ecs_event",
    "to_ocsf_event",
    "to_splunk_event",
    "to_elastic_event",
    # Client
    "SecurityClient",
    "SecurityClientConfig",
    "create_client",
    # Protocol (Phase 3)
    "WebSocketConfig",
    "WebSocketMessage",
    "SubscriptionFilter",
    "WiaWebSocketClient",
    "create_websocket_client",
    "TaxiiConfig",
    "TaxiiDiscovery",
    "TaxiiApiRoot",
    "TaxiiCollection",
    "TaxiiStatus",
    "TaxiiManifestEntry",
    "TaxiiClient",
    "create_taxii_client",
    "SplunkConfig",
    "SplunkAdapter",
    "ElasticConfig",
    "ElasticAdapter",
    "QRadarConfig",
    "QRadarAdapter",
    "create_splunk_adapter",
    "create_elastic_adapter",
    "create_qradar_adapter",
    # Integration (Phase 4)
    "ThreatIntelFeedConfig",
    "IoC",
    "ThreatFeed",
    "MispConfig",
    "MispClient",
    "OtxConfig",
    "OtxClient",
    "VirusTotalConfig",
    "VirusTotalClient",
    "create_misp_client",
    "create_otx_client",
    "create_virustotal_client",
    "SoarConfig",
    "PlaybookAction",
    "Playbook",
    "SoarCase",
    "Artifact",
    "PhantomConfig",
    "PhantomClient",
    "XsoarConfig",
    "XsoarClient",
    "ShuffleConfig",
    "ShuffleClient",
    "create_phantom_client",
    "create_xsoar_client",
    "create_shuffle_client",
    "CloudSecurityConfig",
    "CloudFinding",
    "AwsSecurityHubConfig",
    "AwsSecurityHubClient",
    "AzureSentinelConfig",
    "AzureSentinelClient",
    "GcpSccConfig",
    "GcpSccClient",
    "create_aws_security_hub_client",
    "create_azure_sentinel_client",
    "create_gcp_scc_client",
    "DashboardMetrics",
    "SeverityDistribution",
    "TimeSeriesPoint",
    "TacticCount",
    "TechniqueCount",
    "AlertStats",
    "ThreatLandscape",
    "ComplianceStatus",
    "ControlStatus",
    "DashboardAggregator",
    "ComplianceTracker",
    "create_dashboard_aggregator",
    "create_compliance_tracker",
]