Did I get this right for CIS 6.3? http://i.imgur.com/dX9XZA3.jpg
I would like to get this ok and than add new CIS7 features in so it would be easier to follow conversations.
In overall terms yes, and its a useful diagram 
But there is much more
One correction. HIPS action depends on mode and file status/rules. It typically alerts rather than automatically blocking
HIPS has statuses mainly independent of the rest is CIS, thought there is still some interaction
Best wishes
Mike
Split it for you Hope that’s OK
Making a diagram to understand CIS is a good idea. That diagram could give users a basic knowledge of how their security software works.