Where did Jamf get the "Hardware and Software history" information?

[Thrawnium06]

We have a Mac which installed the macOS 13.5.1 update in the afternoon at 14:48.
This is confirmed by the user as the install.log (/var/log/install.log)

In the afternoon at 14:36 a script was running which checks and reads the macOS version. The corresponding policy log says that he still had macOS 13.5 installed at this time (14:36).

This is another confirmation that the user has made the macOS 13.5.1 update in the afternoon at 14:48.

Now to the unclear:
In the Jamf under "Hardware and Software history" it shows that he already installed the update in the morning at 09:54:

From where did Jamf get this info?
Has anyone else observed this?

(We have not observed this phenomenon on any other device)

[sdagley]

@Thrawnium06 My guess would be that the reported time of the update was in GMT/UTC as opposed to local time for the Mac, but since you mention this is the only device where you're seeing the time discrepancy I'm not very confident in that guess.