There is an error in the definition of built-in policy defined in Azure monitor.

[vkyamaguchi]

The target built-in policy is as follows
https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F3b980d31-7904-4bb7-8575-5665739a8052

docs
https://learn.microsoft.com/en-us/azure/azure-monitor/policy-reference#azure-monitor
An activity log alert should exist for specific Security operations

The following settings are incorrect, causing the target Activity Log Alert to be non-compliant even though it exists.
{
"field": "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals",
"equals": "Security"
}

As with other settings, the following settings are considered correct
{
'field': 'Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals',
'equals': 'Administrative'
}