Determine if keyboard interrupt versus SIGINT trapped?

[Jibunnokage]

I thought I explained that above, but to clarify, to determine the true source of the signal/interrupt, we have a situation where an operator can 'kill' the script while running interactive or via system unit file instance. As an audit control measure we want to be able within the script to tell the difference, if possible, if the SIGINT came from the operator or from monitoring control system. Thus, we want to know if Keyboard Interrupt was done or the SIGINT was from a our monitoring and control system, or if SIGINT was generated by a 3rd party source. Since we can track the SIGINT from the monitoring and control system, we need to still track KeyboardInterrupt or 3rd party source sending SIGINT. The auditors want the MOST details as possible, so the question was posted. Just saying any SIGINT or KeyboardInterrupt not from the monitor and control system, is too much of a catch all for our auditors, unfortunately. If I can prove, with reasonable effort, that there is not method available to avoid the catch all scenario, the auditors will compromise. This thread is part of the investigative effort to prove the is not a reasonable method to do as they requested, and the catch all concept will have to be accepted as best possible option at this time.