We have some existing telemetry around AD Alerting rules, but we should extend it to check for usage of the new KQL filter.