Updates diagrams

Author: paalonso

operations-advisory/multi-cloud-operating-models/operational-security/CISDashboard/README.md

@@ -12,6 +12,93 @@ The **CIS Compliance Dashboard** solution builds the following:
 
 **Architecture diagram**
 
+**Setup flow**
+
+```mermaid
+%%{init: {"theme": "base", "look": "handDrawn", "themeVariables": {"fontFamily": "Oracle Sans, OracleSans, Arial, Helvetica, sans-serif", "fontWeight": "700", "primaryColor": "#fff7e6", "primaryBorderColor": "#2f4858", "primaryTextColor": "#1f2933", "lineColor": "#2f4858", "secondaryColor": "#e8f4f8", "tertiaryColor": "#f5eef8", "clusterBkg": "#fbfbf2", "clusterBorder": "#6b7280"}}}%%
+flowchart LR
+    operator["Security / Cloud Operations User"]
+
+    subgraph setup["<b><span style='font-size:20px'>One-time Log Analytics Setup</span></b>"]
+        log_group["Log Analytics Log Group"]
+        terraform["Terraform Import<br/>oci_log_analytics_import_custom_content"]
+        zip_content["Custom Content ZIP Files<br/>Log sources and parsers"]
+        log_sources["Custom Log Sources and Parsers<br/>CISSummary, CISIdentity, CISNetworking,<br/>CISCompute, CISLoggingMonitoring, CISStorage"]
+        dashboard_json["CISDashboard3.0.json"]
+        dashboard["OCI Management Dashboard<br/>Saved searches, filters, widgets"]
+    end
+
+    operator -->|"Creates / selects"| log_group
+    operator -->|"Runs terraform apply"| terraform
+    zip_content -->|"Referenced by terraform.tfvars"| terraform
+    terraform -->|"Imports / overwrites"| log_sources
+    log_sources -->|"Available to parse uploads in"| log_group
+    operator -->|"Imports dashboard JSON"| dashboard_json
+    dashboard_json --> dashboard
+    dashboard -->|"Queries Log Analytics data in"| log_group
+
+    style setup font-size:20px,font-weight:700
+    classDef person fill:#fff3bf,stroke:#7a4f01,stroke-width:2px,color:#1f2933
+    classDef tool fill:#dff3ff,stroke:#0f5f7a,stroke-width:2px,color:#1f2933
+    classDef content fill:#f6e7ff,stroke:#6f3c8f,stroke-width:2px,color:#1f2933
+    classDef oci fill:#e8f8ee,stroke:#2f7d46,stroke-width:2px,color:#1f2933
+    class operator person
+    class terraform,dashboard_json tool
+    class zip_content,log_sources content
+    class log_group,dashboard oci
+    linkStyle default stroke:#2f4858,stroke-width:2px,stroke-dasharray:5 4
+```
+
+**Compliance execution flow**
+
+```mermaid
+%%{init: {"theme": "base", "look": "handDrawn", "themeVariables": {"fontFamily": "Oracle Sans, OracleSans, Arial, Helvetica, sans-serif", "fontWeight": "700", "primaryColor": "#fff7e6", "primaryBorderColor": "#2f4858", "primaryTextColor": "#1f2933", "lineColor": "#2f4858", "secondaryColor": "#e8f4f8", "tertiaryColor": "#f5eef8", "clusterBkg": "#fbfbf2", "clusterBorder": "#6b7280"}}}%%
+flowchart LR
+    operator["Security / Cloud Operations User"]
+
+    subgraph tenancy["OCI Tenancy"]
+        resources["OCI Resources<br/>IAM, Networking, Compute,<br/>Logging, Storage"]
+        cis_script["OCI CIS Compliance Script<br/>cis_reports.py"]
+        csv_reports["CIS CSV Reports<br/>summary and finding files"]
+        uploader["cisla_upload.py<br/>Cloud Shell delegation token,<br/>instance principal, security token,<br/>or OCI config auth"]
+        namespace["Object Storage Namespace Lookup"]
+        la_upload["Log Analytics<br/>On-demand Upload API"]
+        log_group["Log Analytics Log Group"]
+        log_sources["Imported CIS Log Sources and Parsers"]
+        la_data["Parsed CIS Compliance Records"]
+        dashboard["OCI Management Dashboard<br/>CIS3.0 Compliance"]
+    end
+
+    operator -->|"Runs upload script with report directory and log group OCID"| uploader
+    operator -->|"Runs CIS assessment"| cis_script
+    resources -->|"Scanned by"| cis_script
+    cis_script -->|"Generates"| csv_reports
+    csv_reports --> uploader
+    uploader -->|"Gets namespace"| namespace
+    uploader -->|"Maps each CSV to a CIS log source"| la_upload
+    namespace --> la_upload
+    la_upload -->|"Stores in"| log_group
+    log_sources -->|"Parse matching CSV records"| log_group
+    log_group --> la_data
+    la_data -->|"Queried by Log Analytics saved searches"| dashboard
+    operator -->|"Reviews findings and trends"| dashboard
+
+    style tenancy font-size:20px,font-weight:700
+    classDef person fill:#fff3bf,stroke:#7a4f01,stroke-width:2px,color:#1f2933
+    classDef source fill:#e8f8ee,stroke:#2f7d46,stroke-width:2px,color:#1f2933
+    classDef script fill:#dff3ff,stroke:#0f5f7a,stroke-width:2px,color:#1f2933
+    classDef data fill:#f6e7ff,stroke:#6f3c8f,stroke-width:2px,color:#1f2933
+    classDef service fill:#fde2e2,stroke:#9b2c2c,stroke-width:2px,color:#1f2933
+    class operator person
+    class resources,log_group,dashboard source
+    class cis_script,uploader script
+    class csv_reports,namespace,la_data data
+    class la_upload,log_sources service
+    linkStyle default stroke:#2f4858,stroke-width:2px,stroke-dasharray:5 4
+```
+
+The dashboard has two main paths: a setup path that imports the Log Analytics custom content and dashboard definition, and an operational path that runs the CIS assessment, uploads selected CSV outputs, and visualizes the parsed findings in the OCI Management Dashboard.
+
 You can see an example of how the CIS Dashboard looks like below:
 
 ![CIS Dashboard Example](./files/images/CISDashboard_example.png)