Sergey,

There is no set way to determine the source of records unless all of a particular interface always uses a specific interface form and you can use that to determine it came from that source...

Short of workflow (or in addition to) you could use the keyword $CLIENT_TYPE$ as a field default to capture the client type:

The client type of the API program. When used in workflow, this keyword resolves to a number that corresponds to BMC Remedy Developer Studio, DSO, and so on. The number representations of the different client types are in the ar.h file, which is located in ARServerInstallDir\ARServer\api\include. For example, if you use $CLIENT_TYPE$ in a Run If qualification for an active link, you can cause the active link to execute only for a mid tier client (for example, $CLIENT_TYPE$ = 9 ). For more information on client type of the API program, see List of Client Type ID

The field would have "34" in it if the record was created via a SOAP web service (since you are on 7.6.04 REST really isn't a factor).

The other thing I like to do is grant teams/systems dedicated service accounts for their web services. Then you can look at the submitter (assuming there is not workflow that overwrites it). I even take it so far as to give different accounts to the same team/system for DEV / QA / PROD. That way if their DEV system ends up connected to our production system it had to be conscious decision by somebody on that team to use their PROD account in their DEV system. It also shows records submitted / last modified by as their DEV account