@type event_type() ::
  :intrusion_attempt
  | :malware_detected
  | :policy_violation
  | :suspicious_activity
  | :brute_force
  | :data_exfiltration

@type severity() :: :critical | :high | :medium | :low

@type t() :: %Raxol.Audit.Events.SecurityEvent{
  attack_vector: String.t() | nil,
  blocked: boolean(),
  description: String.t(),
  detection_method: String.t(),
  event_id: String.t(),
  event_type: event_type(),
  metadata: map(),
  response_action: String.t() | nil,
  severity: severity(),
  source_ip: String.t() | nil,
  target_resource: String.t() | nil,
  threat_level: threat_level(),
  timestamp: integer(),
  user_id: String.t() | nil
}

@type threat_level() :: :immediate | :high | :moderate | :low