Spoiler alert: It was me! I'm working with the trial version of SCM and I wanted to make sure it was working so I installed some updates. Sure enough I see an alert, which is awesome! I drill down into the alert details, I see that the security update was installed but it was "InstalledBy : "NT AUTHORITY\\SYSTEM". Can I see who initiated the updates? I'm trying to narrow it down to a username so I can see exactly who was responsible for changes being made.