diff --git a/src/pages/how-to/monitor-system-and-network-activity.mdx b/src/pages/how-to/monitor-system-and-network-activity.mdx
index 9288f8b5..df95b191 100644
--- a/src/pages/how-to/monitor-system-and-network-activity.mdx
+++ b/src/pages/how-to/monitor-system-and-network-activity.mdx
@@ -19,9 +19,9 @@ You can also use the search bar to filter events by activity type.
 </Note>
 
 <Note>
-    The <b>unknown</b> name or e-mail address.
-    In the activity event store, the system keeps the user information in encrypted format. If the encryption key has been corrupted, then in the e-mail address or name fields, it could show "unknown".
-    If the configuration files have been generated by the <b>configure.sh</b> script, then check the backup files in the same folder as the script. Look for the <b>DataStoreEncryptionKey</b> field in the management.json backup files.
+    The <b>unknown</b> name or <b>unknown@unknown.com</b> e-mail address.
+    In the activity event store, the system keeps the deleted user information encrypted. If the encryption key has been corrupted or lost, then the events returned by the API could show "unknown@unknown.com" for the e-mail address field and "unknown" for the name field.
+    If the configuration files have been generated by the <b>configure.sh</b> script, you can find the previous encryption key in the backup files in the same folder as the script. Look for the <b>DataStoreEncryptionKey</b> field in the management.json backup file.
 </Note>
 
 ## Get started