are cloud service provider answer the question
The KQL is sound by there is alerting permission and we had not added it on the azure resource group