I have needed to investigate for unauthorised user access by an employee and found the <Session Security Report> which is somewhat useful.
However, when I check the log it contains entries for (SYSTEM) as the UserID which is confusing and not so helpful.
What is also concerning is that this unidentified (SYSTEM) user seemed to have access to files at unusual hours.
Does anyone else have any experience of this?
Can anyone help me understand how to intepret this?