Alerts for impaired communications

Hi All, I am wondering what others are doing to trigger alerts for impaired communications. If an attacker compromises a server the first thing they will do is try to turn off Defender features or impair communications. I was thinking of adding a custom KQL query to an analytics rule. Wanted to see what others are doing?

Defender impaired communications something like:

DeviceInfo

| where Timestamp > ago(30m)

| where OSPlatform startswith "WindowsServer"

| where DeviceType == "Server"

| where SensorHealthState in ("Impaired communications", "No sensor data", "Inactive")

| where not(RegistryDeviceTag =~ "Decommissioned")

| project Timestamp, DeviceName, SensorHealthState, OSPlatform, DeviceType