diff --git a/viewsh-module-ops/viewsh-module-security-biz/src/main/java/com/viewsh/module/ops/security/integration/listener/SecurityOrderEventListener.java b/viewsh-module-ops/viewsh-module-security-biz/src/main/java/com/viewsh/module/ops/security/integration/listener/SecurityOrderEventListener.java
index 71b1207..d7e1d0a 100644
--- a/viewsh-module-ops/viewsh-module-security-biz/src/main/java/com/viewsh/module/ops/security/integration/listener/SecurityOrderEventListener.java
+++ b/viewsh-module-ops/viewsh-module-security-biz/src/main/java/com/viewsh/module/ops/security/integration/listener/SecurityOrderEventListener.java
@@ -258,12 +258,23 @@ public class SecurityOrderEventListener {
 
     private void handleCancelled(Long orderId, OrderStateChangedEvent event) {
         Long operatorId = event.getOperatorId();
+        OperatorTypeEnum operatorType = event.getOperatorType();
         String remark = event.getRemark();
-        String message = "安保工单已取消";
-        if (remark != null && !remark.isEmpty()) {
-            message += "（" + remark + "）";
+
+        // 区分取消来源
+        String source;
+        if (operatorType == OperatorTypeEnum.SYSTEM) {
+            source = "系统自动取消";
+        } else if (operatorType == OperatorTypeEnum.ADMIN) {
+            source = "管理员手动取消";
+        } else {
+            source = "安保工单已取消";
         }
 
+        String message = remark != null && !remark.isEmpty()
+                ? source + "（" + remark + "）"
+                : source;
+
         recordLog(EventDomain.DISPATCH, LogType.ORDER_CANCELLED, message, orderId, operatorId);
 
         // 取消后自动派发下一个等待工单