diff --git a/azurerm/internal/services/monitor/monitor_activity_log_alert_resource.go b/azurerm/internal/services/monitor/monitor_activity_log_alert_resource.go
index a8dc68829518..534f74dfa3e1 100644
--- a/azurerm/internal/services/monitor/monitor_activity_log_alert_resource.go
+++ b/azurerm/internal/services/monitor/monitor_activity_log_alert_resource.go
@@ -168,6 +168,7 @@ func resourceMonitorActivityLogAlert() *schema.Resource {
 												"Maintenance",
 												"Informational",
 												"ActionRequired",
+												"Security",
 											},
 												false,
 											),
diff --git a/azurerm/internal/services/monitor/monitor_activity_log_alert_resource_test.go b/azurerm/internal/services/monitor/monitor_activity_log_alert_resource_test.go
index 3a71ee520f24..a47c3bcc5d19 100644
--- a/azurerm/internal/services/monitor/monitor_activity_log_alert_resource_test.go
+++ b/azurerm/internal/services/monitor/monitor_activity_log_alert_resource_test.go
@@ -474,7 +474,7 @@ resource "azurerm_monitor_activity_log_alert" "test" {
   criteria {
     category = "ServiceHealth"
     service_health {
-      events    = ["Incident", "Maintenance", "ActionRequired"]
+      events    = ["Incident", "Maintenance", "ActionRequired", "Security"]
       services  = ["Action Groups"]
       locations = ["Global", "West Europe", "East US"]
     }
diff --git a/website/docs/r/monitor_activity_log_alert.html.markdown b/website/docs/r/monitor_activity_log_alert.html.markdown
index 239208e16530..22e8baf7f931 100644
--- a/website/docs/r/monitor_activity_log_alert.html.markdown
+++ b/website/docs/r/monitor_activity_log_alert.html.markdown
@@ -102,7 +102,7 @@ A `criteria` block supports the following:
 
 A `service_health` block supports the following:
 
-* `events` (Optional) Events this alert will monitor Possible values are `Incident`, `Maintenance`, `Informational`, and `ActionRequired`.
+* `events` (Optional) Events this alert will monitor Possible values are `Incident`, `Maintenance`, `Informational`, `ActionRequired` and `Security`.
 * `locations` (Optional) Locations this alert will monitor. For example, `West Europe`. Defaults to `Global`.
 * `services` (Optional) Services this alert will monitor. For example, `Activity Logs & Alerts`, `Action Groups`. Defaults to all Services.