[New Integration] Oracle Cloud Infrastructure (OCI)

## 1. Summary
Collect Oracle Cloud Infrastructure audit logs and Cloud Guard security findings into Elastic Security. The integration consumes an OCI Streaming stream — Oracle's managed message queue — into which the customer routes OCI Audit (control-plane and IAM activity) and Cloud Guard (posture and threat detections). Both sources are parsed into typed, ECS-mapped data streams.

## 2. Vendor and product
OCI is Oracle's public cloud. Rather than pull each OCI service separately, the integration routes data into an OCI Streaming stream and consumes from there.

- **Transport:** OCI Streaming. Despite the name, this is a pull: the integration polls OCI's Streaming API and reads new messages using a cursor, resuming cleanly after any interruption. It is not a push feed.
- **Auth:** a single model — OCI API signing keys (tenancy OCID, user OCID, region, fingerprint, private key). No second credential type.
- **Deployment:** built on CEL, so it runs agentless by default — no Elastic Agent to deploy, Elastic-managed infrastructure does the polling. Customers who need to reach a private stream endpoint can run it agent-based inside their tenancy instead. Agentless needs the stream to have a public endpoint.
- **Getting data into the stream:** the customer sets this up on the OCI side — Cloud Guard problems via an OCI Events Service rule, Audit via a Service Connector Hub. The integration just consumes the stream.

## 3. Data
Two typed data streams, both arriving through the one stream and split apart by the ingest pipeline on event type:

- **Audit** — every call to OCI's management APIs, with caller identity, source IP, action, and outcome. The CloudTrail-equivalent and the main activity source; carries IAM events (logins, policy, user and group changes) within it.
- **Cloud Guard** — OCI's misconfiguration and threat detections, with risk level, problem type (config change vs activity), problem name and description, affected resource and compartment, detection times, and a recommendation. Delivered as problem lifecycle events: detected, dismissed, remediated.

We're deliberately scoping to these two. Service logs (VCN flow, load balancer, WAF, object storage) can follow, but Audit and Cloud Guard are the core security value — the activity trail plus native findings.

## 4. What we get
OCI audit activity and Cloud Guard findings in Elastic, parsed and mapped to ECS, sitting next to a customer's other cloud data (AWS, Azure, GCP) so OCI stops being a blind spot in a multi-cloud estate. Audit identity and IP fields map cleanly to ECS user, source and user-agent fields; Cloud Guard risk level, status, resource and compartment map to finding fields. Comes with dashboards and detection rules focused on the security use cases — risky IAM changes, new critical findings, public buckets, instance changes.

## 5. Dashboards
Two views, one per stream.

**Cloud Guard findings**
- findings by risk level (critical/high/medium/low) and by status (open, dismissed, resolved)
- problem types — config change vs activity — over time
- top problem names and detectors
- most-affected resources and compartments
- a recent-findings table for triage

**Audit / IAM activity**
- events over time, top callers and source IPs
- failed vs successful calls
- IAM changes — policy, user and group activity
- a recent-activity table

## 6. References
- [OCI Cloud Guard](https://docs.oracle.com/en-us/iaas/cloud-guard/using/index.htm)
- [OCI Streaming — consuming messages](https://docs.oracle.com/en-us/iaas/Content/Streaming/Tasks/consuming.htm)
- [OCI Events Service](https://docs.oracle.com/en-us/iaas/Content/Events/Concepts/eventsoverview.htm)
- [Service Connector Hub](https://docs.oracle.com/en-us/iaas/Content/connector-hub/overview.htm)
- [OCI Audit event reference](https://docs.oracle.com/en-us/iaas/Content/Audit/Reference/logeventreference.htm)

Start with the OCI Streaming consuming documentation and the linked OCI Audit and Cloud Guard references to understand the input events and cursor-based polling. The work is complete when Audit and Cloud Guard data are consumed as two typed, ECS-mapped streams with the described dashboards and detection rules.

Written by the indexing model from the issue text.