how to distinguish learner vs. admin withdrawals in alert?

Summary:

What is the best approach in an Alert to distinguish between withdrawals initiated by learners and those processed by Administrator?

Content:

In our system, there are cases where a learner withdraws from a course themselves, and other times where an administrator cancel the course. However, in both situations, the course status changes to ${assignmentStatus} = 'ORA_ASSN_REC_WITHDRAWN', making it unclear who performed the action.

Given that the status remains the same in both cases, how can we modify the alert to explicitly indicate whether the course was withdrawn by the learner or by an administrator? Are there any available fields (such as