Network Security Group Monitoring

Microsoft

Feb 03, 2021

cgoenka, I'm not sure to be honest. I wouldn't think it should through a invalid query so my guess is something else is going on that I didn't consider! If you want run the following query in Resource Graph Explorer to just verify the query works in your environment!

Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.defaultSecurityRules,subscriptionId
| mvexpand SecurityRules
| union (Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.securityRules,subscriptionId
| mvexpand SecurityRules)
| join kind=leftouter (ResourceContainers
| where type == "microsoft.resources/subscriptions"
) on $left.subscriptionId==$right.subscriptionId
| extend Protocol=SecurityRules.properties.protocol,DestinationAddressPrefix=iff(SecurityRules.properties.destinationAddressPrefix=='[]',SecurityRules.properties.destinationAddressPrefixes,SecurityRules.properties.destinationAddressPrefix),destinationPortRanges=iif(SecurityRules.properties.destinationPortRanges=='[]',SecurityRules.properties.destinationPortRange,SecurityRules.properties.destinationPortRanges),SourceAddressPrefix=iif(SecurityRules.properties.sourceAddressPrefix=='[]',SecurityRules.properties.sourceAddressPrefixes,SecurityRules.properties.sourceAddressPrefix),sourcePortRanges=iif(SecurityRules.properties.sourcePortRanges=='[]',SecurityRules.properties.sourcePortRange,SecurityRules.properties.sourcePortRanges),Direction=tostring(SecurityRules.properties.direction),Priority=toint(SecurityRules.properties.priority),Access=SecurityRules.properties.access
| project Internet=iif((tostring(Direction) == 'Inbound' and tostring(SourceAddressPrefix) in ('Internet','*') and tostring(Access)=="Allow"),1,0),NSG=name, Rule=SecurityRules.name, Subscription=name1,ResourceGroup=resourceGroup,Protocol,DestinationAddressPrefix,destinationPortRanges,SourceAddressPrefix,sourcePortRanges,Direction,Priority,Access,NetworkInterfaces,Subnets
//| where tostring(Direction) =~ "{Direction}" or 'Both' =~ '{Direction}'
| order by NSG, Direction, Priority asc

Blog Post