SharePoint System Account - SHAREPOINT/System - File Events From Information Management Policy

Microsoft allows you to use Microsoft 365 retention to automatically retain and delete content across SharePoint, OneDrive, Teams, Exchange, and other Microsoft services.  This Microsoft Knowlegebase Article  will provide further details about other information management policies as well.

Microsoft's Information Management Policies may produce File Events where the user is listed as SHAREPOINT\system, this would be an example:

• The Default severity setting for these events is low which can be triggered by file actions.  SaaS Alerts maintains these for logging purposes, but they have no stand alone security value.
  
  
• Consider using this information to filter out potential noise in respond events (such as file action limit events)