@Ray Silver: "The Action Group we just created will now be available for use when configuring future alerts." Closed captioning was recently added as a requirement on new Ch9 videos. Since this video is a bit older, it hasn't had captions added yet.
@hfleitas:The best way to create an activity log alert is to start from an event in the Activity Log and look at the properties of that event. Azure Security Center events are always in the "Security" category, but for an advanced threat detection in particular it's best to create an alert after finding a sample event.