pub fn from_srum(
network: &[NetworkUsageRecord],
app_usage: &[AppUsageRecord],
id_map: &[IdMapEntry],
) -> Vec<UserActivity>Expand description
Normalize SRUM network-usage and app-usage records into UserActivity events.
Each record → Action::Executed, attributed to the user SID resolved from the
id-map (falling back to a user-id:<n> token when unresolved). The application
resolves to its path (falling back to app-id:<n>). Network rows carry their
<bytes_sent>↑ / <bytes_recv>↓ bytes in detail; app-usage rows carry their
foreground/background CPU cycles. The DateTime<Utc> timestamp becomes Unix
epoch seconds.