Granular Action Attribution in the Case Activity Log

This feature will introduce clear, accurate attribution for every case action in the Cases activity log. When a case is modified by an AI agent, a workflow, a detection rule, an attack, or an API call, the activity log will display the action using the format "[username] via [source name] [action]" identifying both the user associated with the action and the specific source that initiated it. Actions taken directly by users are unchanged.

**Value proposition**

Currently, case actions initiated by automated or AI-assisted sources are attributed to a generic system identity, giving reviewers no way to determine who authorized the action or what triggered it. For teams using Cases as a compliance and audit trail, this is a meaningful gap: the activity log cannot answer "who approved this?" With this update, case users will be able to trace every case change back to a real user and a specific source, making the activity log a reliable record for AI-assisted and automated workflows.

**Expected outcome**
After this update, you will be able to:

- See the triggering user and source name for any case action initiated by an agent, workflow, rule, attack, or API call.
- Distinguish AI-assisted and automated actions from direct human actions at a glance in the activity feed.
- Use the Cases activity log as a trustworthy audit trail even in environments where AI agents and automated workflows are actively managing cases.

Start by locating the Cases activity log and the code paths that attribute actions from agents, workflows, detection rules, attacks, and API calls. Define how the triggering user and source name map to the format "[username] via [source name] [action]", while preserving direct-user actions, then add coverage for each listed source.

Written by the indexing model from the issue text.