Attachment table/record attachment tab 'Updated By' field will have a value of 'system' when attaching a document to a recordIssue When a user attaches a document to a record, the sys_attachment table or the attachment tab section with the form 'Updated By' field value will display as 'System'. ReleaseMadrid and onwards.CauseThis is due to the ServiceNow Antivirus Program (com.glide.snap) plugin. This plugin is activated by default starting with Madrid instances. When an attachment is added to a record, the antivirus will run a scan on this attachment, a job record is created by the antivirus scan job. This, therefore, sets the 'Updated By' field value to 'System'. ResolutionThis is expected behaviour. If you prefer, so that the 'Updated By' field value does not display 'System' you can disable the antivirus scan job. However, this would not be recommended. Please take a look at the ServiceNow documentation for more information on antivirus scan in the platform:https://docs.servicenow.com/csh?topicname=antivirus-protection.html&version=latest