Hi
@Kai Tingey
1. Check sys_audit and sys_audit_delete Tables More Deeply
You may have already looked, but try filtering these tables precisely:
Table: sys_audit
Field name: email
Table name: e.g., sys_user
Changed between: Use the time range around 6:30 AM
Add columns for: Created, User, Fieldname, Old Value, New Value
If the User is "system" or a specific integration user, that can give a clue.
2. Scripted Background Jobs or Fix Scripts
While you’ve ruled out scheduled jobs, check for:
Fix Scripts in System Definition > Fix Scripts.
Script Includes or background scripts that could be running on a time-based trigger (via custom script logic).
Look for scripts with toLowerCase() or manipulating email.
Try:
email.toLowerCase()
Search across all script types using "Studio" > Global Search or Script Search in the Application Navigator (Script Search plugin).
3. Business Rules
Check for Business Rules on sys_user that might fire on update or insert.
Filter by:
Table: sys_user
When: before or after
Insert / Update: true
Active: true
Look for any rule that may standardize email addresses.
4. Integration or Inbound APIs
Even if nothing is scheduled, an external system (e.g., an HR platform or identity manager) might be pushing updates early in the morning.
Check syslog_transaction or ecc_queue for integration activity around that time.
Look at REST API logs in System Web Services > REST API Explorer > Logs, especially if you're using MID Servers or external sources.
5. MID Server or Discovery
If Discovery or Orchestration is running at off-hours, and user data is tied to a CI or another discovery process, it could be updating attributes.
Look in:
Discovery Logs
Orchestration Debug
Scheduled Data Sources
6. Set a Watchdog Script
If all else fails, set up a temporary Business Rule to log or notify you when the email field is changed to lowercase.
Example:
javascript
Copy
Edit
// Business Rule: "Track Email Lowercase Changes"
if (current.email != previous.email && current.email == current.email.toLowerCase()) {
gs.log("Email changed to lowercase for user: " + current.name + " by: " + gs.getUserName());
}
Set it as:
Table: sys_user
When: after
Filter condition: email changes
You can even send an email or log extra context like gs.getUserID() or client IP.
If my response helped please mark it correct
Thanks, and Regards,
Suyash
