Which of the following should an administrator check FIRST in order to prove or disprove this claim?

A user is convinced that someone is attempting to use their user account at night. Which of the following should an administrator check FIRST in order to prove or disprove this claim?

A.
The IDS logs

B.
The security application logs

C.
The local security logs

D.
The firewall logs