Illumio Enforcement Change Analytic Rule

Original query, unchanged.

let enf_state = dynamic(["full", "selective"]);
let visibility_state = dynamic(["visibility_only", "idle"]);
Illumio_Auditable_Events_CL
| union IllumioSyslogAuditEvents
| extend temp_resource_changes = parse_json(resource_changes)[0]
| where event_type == 'workloads.update' 
| extend old_mode = temp_resource_changes.changes.enforcement_mode.before,
        new_mode = temp_resource_changes.changes.enforcement_mode.after,
        workload_href = temp_resource_changes.resource.workload.href,
        workload_name = temp_resource_changes.resource.workload.hostname,
        ipaddress = action.src_ip
| where new_mode in (visibility_state) and old_mode in (enf_state)
| project-away temp_*
| project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress