Add test for adding is_suspicious change event