Workflow needs to be triggered only for the identities who have HR source, please advise.
You may try the Native Change Accounts trigger upon account creation which triggers a Workflow when a new account external to Identity Security Cloud was created.
cloudAuthoritativeSource is one of the attributes you’ll retrieve when you run the Get Identity action, but it’s not part of the payload in the event trigger. You’d have to do the filtering after the Get Identity Action.