Struct SrumSource 

pub struct SrumSource<'a> { /* private fields */ }

A SrumSource wraps borrowed SRUM network-usage and app-usage records plus the SruDbIdMapTable that resolves their integer user_id / app_id foreign keys to user SIDs and application paths.

SRUM is the first source that attributes activity to a specific user: each row becomes an Action::Executed UserActivity whose actor is the resolved user SID. Network rows additionally carry the per-interval byte volume in detail, sharpening the exfiltration lens.

Implementations

impl<'a> SrumSource<'a>

pub fn new( network: &'a [NetworkUsageRecord], app_usage: &'a [AppUsageRecord], id_map: &'a [IdMapEntry], ) -> Self

Wrap decoded SRUM records with the id-map needed to resolve users and apps.

Trait Implementations

impl ActivitySource for SrumSource<'_>

fn activities(&self) -> Vec<UserActivity>

The activities this source contributes to the timeline.