Why do you need exact syntax here?

It wont give you exact T-SQL and i don't think it's needed in your case. If it says Type as "database" and DDL Operation as ALTER in the report, then some one ran ALTER Database stmnt. And it also gives you exact time and the Login Name in this report. Now you can verify in your error logs at the exact same time, it logs something similar to "Setting database Option Offline to ON for database......."