Extended event to track the logins from a specific login, but that login is filtering on a an active directory group
You cannot filter on the AD group.
This previous question explains how the access management works with AD groups:
How to tell which windows group login I used when logging in via windows authentication