diff --git a/website/pages/docs/enterprise/sentinel/examples.mdx b/website/pages/docs/enterprise/sentinel/examples.mdx
index 0d0d85fad2..ca65de227e 100644
--- a/website/pages/docs/enterprise/sentinel/examples.mdx
+++ b/website/pages/docs/enterprise/sentinel/examples.mdx
@@ -25,7 +25,7 @@ import "strings"
 
 # We expect logins to come only from our private IP range
 cidrcheck = rule {
-    sockaddr.is_contained(request.connection.remote_addr, "10.20.0.0/16")
+    sockaddr.is_contained("10.20.0.0/16", request.connection.remote_addr)
 }
 
 # Require Ping MFA validation to succeed