The system records the GUID of the login that executed the operation causing a trigger to fire.

If the trigger causes the execution of a workflow this GUID is passed in the 'action_Login' parameter. If the trigger causes alerts to be sent to client the GUID is included in the alert packet.