Network Security Group Monitoring

Published Feb 03 2021 12:00 AM 4,631 Views
Microsoft

 

Intro

Brad Watts here to explore monitoring of your Network Security Groups (NSGs). I was approached recently by a customer wanting to better understand changes being made to the many NSGs in their environment. Working with them, we came up with an Azure Workbook that provides a centralized view of both current settings on your NSGs along with any changes that have been made. 

 

Sneek Peak 

Before we jump into implementation let’s look at the result. Our Workbook has two tabs. The first tab is “Current Settings” and uses Azure Resource Graph to pull in current NSG settings.  

 

bwatts670_0-1611844320508.png

 

On the “Audit Settings” tab we are focusing on the changes made to NSGs 

bwatts670_1-1611844320482.png

 

If you select one of the changes from the “NSG Changes” table, it will show you what NIC/Subnet it’s connected to along with all the changes over the last 90 days. 

bwatts670_2-1611844320513.png

 

Prerequisites 

If your interested in implementing this Workbook you need to be aware of a few requirements: 

  • Whoever is using the Workbook will need at least read access to the NSGs they are wanting to monitor. This is because we are using Azure Resource Graph to pull this information. 
  • For the “Audit Change” tab to work you need to send you’re Azure Activity Logs to a Log Analytics Workspace. 

Azure Activity log - Azure Monitor | Microsoft Docs 

 

  • Whoever is using the Workbook will need to be able to read the data in the Log Analytics workspace that you sent the Azure Activity Logs to. 

Implementing 

Hopefully, everyone is still interested and want to take a look at this in your environment. Well lets walk through importing the workbook! 

 

Step 1: Get the Workbook 

You can find a copy of this workbook in my Github repo. You just need to copy the content of this JSON file to import it. 

 

https://raw.githubusercontent.com/bwatts64/AzureMonitor/master/Workbooks/NSGWorkbook.json 

 

Step 2: Create a Workbook 

In the Azure Portal bring up Azure Monitor by searching for Monitor 

bwatts670_3-1611844320489.png

 

In Azure Monitor select the “Workbook” tab and choose “New” 

bwatts670_4-1611844320517.png

 

This will open a Workbook in Edit mode. Do to the “Advanced Editor” (</>) 

bwatts670_5-1611844320495.png

 

 In the “Advanced Editor” paste the content of the JSON file from my GitHub repo and click on “Apply” 

bwatts670_6-1611844320499.png

 

That’s it. You know have the Workbook to test in your environment. Make sure you “Save” the workbook and also click on the “Done Editing” to get the full experience. 

bwatts670_7-1611844320501.png

Summary 

Being able to easily visualize both you’re current NSGs along with any changes made to them over time is essential for anyone managing NSGs in Azure. In this solution we are using an Azure Workbook along with Log Analytics and Azure Resource Graph to give you that centralized view. I hope this makes your life easier and please suggest improvements to the Workbook. I always consider these things works in progress! A similar Workbook for Azure Firewalls is in progress. 

5 Comments
Senior Member

Great workbook! Quick question in Current settings if a sub has more than 300+ NSGs will the RG query still work as it did not work for me for one sub and even for all subs when I select it throws me query invalid error.

Microsoft

@cgoenka, I'm not sure to be honest. I wouldn't think it should through a invalid query so my guess is something else is going on that I didn't consider! If you want run the following query in Resource Graph Explorer to just verify the query works in your environment!

 

Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.defaultSecurityRules,subscriptionId
| mvexpand SecurityRules
| union (Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.securityRules,subscriptionId
| mvexpand SecurityRules)
| join kind=leftouter (ResourceContainers
| where type == "microsoft.resources/subscriptions"
) on $left.subscriptionId==$right.subscriptionId
| extend Protocol=SecurityRules.properties.protocol,DestinationAddressPrefix=iff(SecurityRules.properties.destinationAddressPrefix=='[]',SecurityRules.properties.destinationAddressPrefixes,SecurityRules.properties.destinationAddressPrefix),destinationPortRanges=iif(SecurityRules.properties.destinationPortRanges=='[]',SecurityRules.properties.destinationPortRange,SecurityRules.properties.destinationPortRanges),SourceAddressPrefix=iif(SecurityRules.properties.sourceAddressPrefix=='[]',SecurityRules.properties.sourceAddressPrefixes,SecurityRules.properties.sourceAddressPrefix),sourcePortRanges=iif(SecurityRules.properties.sourcePortRanges=='[]',SecurityRules.properties.sourcePortRange,SecurityRules.properties.sourcePortRanges),Direction=tostring(SecurityRules.properties.direction),Priority=toint(SecurityRules.properties.priority),Access=SecurityRules.properties.access
| project Internet=iif((tostring(Direction) == 'Inbound' and tostring(SourceAddressPrefix) in ('Internet','*') and tostring(Access)=="Allow"),1,0),NSG=name, Rule=SecurityRules.name, Subscription=name1,ResourceGroup=resourceGroup,Protocol,DestinationAddressPrefix,destinationPortRanges,SourceAddressPrefix,sourcePortRanges,Direction,Priority,Access,NetworkInterfaces,Subnets
//| where tostring(Direction) =~ "{Direction}" or 'Both' =~ '{Direction}'
| order by NSG, Direction, Priority asc
Microsoft

Well done!!  Super helpful.  Thank you sir!

 
Senior Member
@bwatts670  - The mentioned query works in my environment. 

 

Microsoft

@cgoenka could you try just selecting a couple NSGs and see if the workbook renders it correctly. I'm thinking that it could possibly be the below part of the query. In the workbook it's not commented. If we verify that's the cause I'll look at a different way to filter it.

//| where id in~ ({selectedNSG})

 

%3CLINGO-SUB%20id%3D%22lingo-sub-2106308%22%20slang%3D%22en-US%22%3ENetwork%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2106308%22%20slang%3D%22en-US%22%3E%3CH3%20id%3D%22toc-hId-1627410551%22%20id%3D%22toc-hId-1969234871%22%3E%26nbsp%3B%3C%2FH3%3E%0A%3CH3%20id%3D%22toc-hId--924746410%22%20id%3D%22toc-hId-161780408%22%3EIntro%3C%2FH3%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EBrad%20Watts%26nbsp%3Bhere%26nbsp%3Bto%20explore%26nbsp%3Bmonitoring%26nbsp%3Bof%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Eyour%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3BNetwork%20Security%20Groups%20(NSGs).%20I%20was%20approached%20recently%20by%20a%20customer%20wanting%20to%20better%20understand%20changes%20being%20made%20to%20the%20many%20NSGs%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Bin%20their%20environment%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%20Working%20with%20them%3C%2FSPAN%3E%3CSPAN%3E%2C%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Bwe%20came%20up%20with%20an%20Azure%20Workbook%20that%20provides%20a%20centralized%20view%20of%20both%20current%20settings%20on%20your%20NSGs%20along%20with%20any%20changes%20that%20have%20been%20made.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%222%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20aria-level%3D%222%22%20id%3D%22toc-hId-818063925%22%20id%3D%22toc-hId--1645674055%22%3E%3CSPAN%20data-contrast%3D%22none%22%3ESneek%20Peak%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EBefore%20we%20jump%20into%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Eimplementation%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Elet%E2%80%99s%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Blook%20at%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Ethe%20result%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%20Our%20Workbook%20has%20two%20tabs.%20The%20first%20tab%20is%20%E2%80%9CCurrent%20Settings%E2%80%9D%20and%20uses%20Azure%20Resource%20Graph%20to%20pull%20in%20current%20NSG%20settings.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_0-1611844320508.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250280i7ECABE9754FAF488%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_0-1611844320508.png%22%20alt%3D%22bwatts670_0-1611844320508.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3EOn%20the%20%E2%80%9CAudit%20Settings%E2%80%9D%20tab%20we%20are%20focusing%20on%20the%20changes%20made%20to%20NSGs%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_1-1611844320482.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250281iDA79E625A95FBFE8%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_1-1611844320482.png%22%20alt%3D%22bwatts670_1-1611844320482.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3EIf%20you%20select%20one%20of%20the%20changes%20from%20the%20%E2%80%9CNSG%20Changes%E2%80%9D%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3Etable%2C%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3E%26nbsp%3Bit%20will%20show%20you%20what%20NIC%2FSubnet%20it%E2%80%99s%20connected%20to%20along%20with%20all%20the%20changes%20over%20the%20last%2090%20days.%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_2-1611844320513.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250282i790199D2102FC595%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_2-1611844320513.png%22%20alt%3D%22bwatts670_2-1611844320513.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22none%22%3EPrerequisites%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EIf%26nbsp%3Byour%26nbsp%3Binterested%20in%20implementing%20this%20Workbook%20you%20need%20to%20be%20aware%20of%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Ea%20few%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Brequirements%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%20data-contrast%3D%22auto%22%3EWhoever%20is%20using%20the%20Workbook%20will%20need%20at%20least%20read%20access%20to%20the%20NSGs%20they%20are%20wanting%20to%20monitor%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%20This%20is%20because%20we%20are%20using%26nbsp%3BAzure%26nbsp%3BResource%20Graph%20to%20pull%20this%20information.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%20data-contrast%3D%22auto%22%3EFor%20the%20%E2%80%9CAudit%20Change%E2%80%9D%20tab%20to%20work%20you%20need%20to%20send%26nbsp%3Byou%E2%80%99re%26nbsp%3BAzure%20Activity%20Logs%20to%20a%20Log%20Analytics%20Workspace.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Factivity-log%23send-to-log-analytics-workspace%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EAzure%20Activity%20log%20-%20Azure%20Monitor%20%7C%20Microsoft%20Docs%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559685%26quot%3B%3A720%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%20data-contrast%3D%22auto%22%3EWhoever%20is%20using%20the%20Workbook%20will%20need%20to%20be%20able%20to%20read%20the%20data%20in%20the%20Log%20Analytics%20workspace%20that%20you%20sent%20the%20Azure%20Activity%20Logs%20to.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CH3%20aria-level%3D%222%22%20id%3D%22toc-hId--1734093036%22%20id%3D%22toc-hId-841838778%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EImplementing%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EHopefully%2C%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3Beveryone%20is%20still%20interested%20and%26nbsp%3Bwant%26nbsp%3Bto%26nbsp%3Btake%20a%20look%26nbsp%3Bat%20this%20in%20your%20environment.%20Well%26nbsp%3Blets%26nbsp%3Bwalk%20through%20importing%20the%20workbook!%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%223%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH4%20aria-level%3D%223%22%20id%3D%22toc-hId--187796206%22%20id%3D%22toc-hId-1532400252%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EStep%201%3A%20Get%26nbsp%3Bthe%26nbsp%3BWorkbook%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FH4%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EYou%20can%20find%20a%20copy%20of%20this%20workbook%20in%20my%26nbsp%3BGithub%26nbsp%3Brepo.%20You%20just%20need%20to%20copy%20the%20content%20of%20this%20JSON%20file%20to%20import%20it.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fraw.githubusercontent.com%2Fbwatts64%2FAzureMonitor%2Fmaster%2FWorkbooks%2FNSGWorkbook.json%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ehttps%3A%2F%2Fraw.githubusercontent.com%2Fbwatts64%2FAzureMonitor%2Fmaster%2FWorkbooks%2FNSGWorkbook.json%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%223%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH4%20aria-level%3D%223%22%20id%3D%22toc-hId-1555014129%22%20id%3D%22toc-hId--275054211%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EStep%202%3A%20Create%20a%20Workbook%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FH4%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EIn%20the%20Azure%20Portal%20bring%20up%20Azure%20Monitor%20by%20searching%20for%20Monitor%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_3-1611844320489.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250283i69B1750AE832B793%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_3-1611844320489.png%22%20alt%3D%22bwatts670_3-1611844320489.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EIn%20Azure%20Monitor%20select%20the%20%E2%80%9CWorkbook%E2%80%9D%20tab%20and%20choose%20%E2%80%9CNew%E2%80%9D%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_4-1611844320517.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250285iCD745DD8E60A2C94%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_4-1611844320517.png%22%20alt%3D%22bwatts670_4-1611844320517.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3EThis%20will%20open%20a%20Workbook%20in%20Edit%20mode.%20Do%20to%20the%20%E2%80%9CAdvanced%20Editor%E2%80%9D%20()%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_5-1611844320495.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250284i0B08E3B21DE358E3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_5-1611844320495.png%22%20alt%3D%22bwatts670_5-1611844320495.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3EIn%20the%20%E2%80%9CAdvanced%20Editor%E2%80%9D%20paste%20the%20content%20of%20the%20JSON%20file%20from%20my%20GitHub%20repo%20and%20click%20on%20%E2%80%9CApply%E2%80%9D%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_6-1611844320499.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250286i7D0E34A2DA5C0828%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_6-1611844320499.png%22%20alt%3D%22bwatts670_6-1611844320499.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3EThat%E2%80%99s%20it.%20You%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%3Ek%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22auto%22%3Enow%20have%20the%20Workbook%20to%20test%20in%20your%20environment.%20Make%20sure%20you%20%E2%80%9CSave%E2%80%9D%20the%20workbook%20and%20also%20click%20on%20the%20%E2%80%9CDone%20Editing%E2%80%9D%20to%20get%20the%20full%20experience.%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22bwatts670_7-1611844320501.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F250287iF3AE5BCB64E2584B%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22bwatts670_7-1611844320501.png%22%20alt%3D%22bwatts670_7-1611844320501.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--800629327%22%20id%3D%22toc-hId--285557315%22%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22none%22%3ESummary%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FH3%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22auto%22%3EBeing%20able%20to%20easily%20visualize%20both%26nbsp%3Byou%E2%80%99re%26nbsp%3Bcurrent%20NSGs%20along%20with%20any%20changes%20made%20to%20them%20over%20time%20is%20essential%20for%20anyone%20managing%20NSGs%20in%20Azure.%20In%20this%20solution%20we%20are%20using%20an%20Azure%20Workbook%20along%20with%20Log%20Analytics%20and%20Azure%20Resource%20Graph%20to%20give%20you%20that%20centralized%20view.%20I%20hope%20this%20makes%20your%20life%20easier%20and%20please%20suggest%20improvements%20to%20the%20Workbook.%20I%20always%20consider%20these%20things%26nbsp%3Bworks%26nbsp%3Bin%20progress!%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E%26nbsp%3BA%20similar%20Workbook%20for%20Azure%20Firewalls%20is%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3Ein%20progress%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22auto%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2106308%22%20slang%3D%22en-US%22%3E%3CP%3EExplore%20a%20central%20way%20to%20visualize%20your%20NSGs%20and%20track%20changes%20made%20to%20them.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2106308%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ebradwatts%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2114368%22%20slang%3D%22en-US%22%3ERe%3A%20Network%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2114368%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F719681%22%20target%3D%22_blank%22%3E%40cgoenka%3C%2FA%3E%26nbsp%3Bcould%20you%20try%20just%20selecting%20a%20couple%20NSGs%20and%20see%20if%20the%20workbook%20renders%20it%20correctly.%20I'm%20thinking%20that%20it%20could%20possibly%20be%20the%20below%20part%20of%20the%20query.%20In%20the%20workbook%20it's%20not%20commented.%20If%20we%20verify%20that's%20the%20cause%20I'll%20look%20at%20a%20different%20way%20to%20filter%20it.%3C%2FP%3E%0A%3CPRE%3E%2F%2F%7C%20where%20id%20in~%20(%7BselectedNSG%7D)%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2113538%22%20slang%3D%22en-US%22%3ERe%3A%20Network%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2113538%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F440877%22%20target%3D%22_blank%22%3E%40bwatts670%3C%2FA%3E%26nbsp%3B%20-%20The%20mentioned%20query%20works%20in%20my%20environment.%26nbsp%3B%3C%2FDIV%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2112662%22%20slang%3D%22en-US%22%3ERe%3A%20Network%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2112662%22%20slang%3D%22en-US%22%3E%3CP%3EWell%20done!!%26nbsp%3B%20Super%20helpful.%26nbsp%3B%20Thank%20you%20sir!%3C%2FP%3E%0A%3CDIV%20class%3D%22ms-editor-squiggler%22%20style%3D%22color%3A%20initial%3B%20font%3A%20initial%3B%20font-feature-settings%3A%20initial%3B%20font-kerning%3A%20initial%3B%20font-optical-sizing%3A%20initial%3B%20font-variation-settings%3A%20initial%3B%20forced-color-adjust%3A%20initial%3B%20text-orientation%3A%20initial%3B%20text-rendering%3A%20initial%3B%20-webkit-font-smoothing%3A%20initial%3B%20-webkit-locale%3A%20initial%3B%20-webkit-text-orientation%3A%20initial%3B%20-webkit-writing-mode%3A%20initial%3B%20writing-mode%3A%20initial%3B%20zoom%3A%20initial%3B%20place-content%3A%20initial%3B%20place-items%3A%20initial%3B%20place-self%3A%20initial%3B%20alignment-baseline%3A%20initial%3B%20animation%3A%20initial%3B%20appearance%3A%20initial%3B%20aspect-ratio%3A%20initial%3B%20backdrop-filter%3A%20initial%3B%20backface-visibility%3A%20initial%3B%20background%3A%20initial%3B%20background-blend-mode%3A%20initial%3B%20baseline-shift%3A%20initial%3B%20block-size%3A%20initial%3B%20border-block%3A%20initial%3B%20border%3A%20initial%3B%20border-radius%3A%20initial%3B%20border-collapse%3A%20initial%3B%20border-inline%3A%20initial%3B%20inset%3A%20initial%3B%20box-shadow%3A%20initial%3B%20box-sizing%3A%20initial%3B%20break-after%3A%20initial%3B%20break-before%3A%20initial%3B%20break-inside%3A%20initial%3B%20buffered-rendering%3A%20initial%3B%20caption-side%3A%20initial%3B%20caret-color%3A%20initial%3B%20clear%3A%20initial%3B%20clip%3A%20initial%3B%20clip-path%3A%20initial%3B%20clip-rule%3A%20initial%3B%20color-interpolation%3A%20initial%3B%20color-interpolation-filters%3A%20initial%3B%20color-rendering%3A%20initial%3B%20color-scheme%3A%20initial%3B%20columns%3A%20initial%3B%20column-fill%3A%20initial%3B%20gap%3A%20initial%3B%20column-rule%3A%20initial%3B%20column-span%3A%20initial%3B%20contain%3A%20initial%3B%20contain-intrinsic-size%3A%20initial%3B%20content%3A%20initial%3B%20content-visibility%3A%20initial%3B%20counter-increment%3A%20initial%3B%20counter-reset%3A%20initial%3B%20counter-set%3A%20initial%3B%20cursor%3A%20initial%3B%20cx%3A%20initial%3B%20cy%3A%20initial%3B%20d%3A%20initial%3B%20display%3A%20block%3B%20dominant-baseline%3A%20initial%3B%20empty-cells%3A%20initial%3B%20fill%3A%20initial%3B%20fill-opacity%3A%20initial%3B%20fill-rule%3A%20initial%3B%20filter%3A%20initial%3B%20flex%3A%20initial%3B%20flex-flow%3A%20initial%3B%20float%3A%20initial%3B%20flood-color%3A%20initial%3B%20flood-opacity%3A%20initial%3B%20grid%3A%20initial%3B%20grid-area%3A%20initial%3B%20height%3A%20initial%3B%20hyphens%3A%20initial%3B%20image-orientation%3A%20initial%3B%20image-rendering%3A%20initial%3B%20inline-size%3A%20initial%3B%20inset-block%3A%20initial%3B%20inset-inline%3A%20initial%3B%20isolation%3A%20initial%3B%20letter-spacing%3A%20initial%3B%20lighting-color%3A%20initial%3B%20line-break%3A%20initial%3B%20list-style%3A%20initial%3B%20margin-block%3A%20initial%3B%20margin%3A%20initial%3B%20margin-inline%3A%20initial%3B%20marker%3A%20initial%3B%20mask%3A%20initial%3B%20mask-type%3A%20initial%3B%20max-block-size%3A%20initial%3B%20max-height%3A%20initial%3B%20max-inline-size%3A%20initial%3B%20max-width%3A%20initial%3B%20min-block-size%3A%20initial%3B%20min-height%3A%20initial%3B%20min-inline-size%3A%20initial%3B%20min-width%3A%20initial%3B%20mix-blend-mode%3A%20initial%3B%20object-fit%3A%20initial%3B%20object-position%3A%20initial%3B%20offset%3A%20initial%3B%20opacity%3A%20initial%3B%20order%3A%20initial%3B%20origin-trial-test-property%3A%20initial%3B%20orphans%3A%20initial%3B%20outline%3A%20initial%3B%20outline-offset%3A%20initial%3B%20overflow-anchor%3A%20initial%3B%20overflow-wrap%3A%20initial%3B%20overflow%3A%20initial%3B%20overscroll-behavior-block%3A%20initial%3B%20overscroll-behavior-inline%3A%20initial%3B%20overscroll-behavior%3A%20initial%3B%20padding-block%3A%20initial%3B%20padding%3A%20initial%3B%20padding-inline%3A%20initial%3B%20page%3A%20initial%3B%20page-orientation%3A%20initial%3B%20paint-order%3A%20initial%3B%20perspective%3A%20initial%3B%20perspective-origin%3A%20initial%3B%20pointer-events%3A%20initial%3B%20position%3A%20initial%3B%20quotes%3A%20initial%3B%20r%3A%20initial%3B%20resize%3A%20initial%3B%20ruby-position%3A%20initial%3B%20rx%3A%20initial%3B%20ry%3A%20initial%3B%20scroll-behavior%3A%20initial%3B%20scroll-margin-block%3A%20initial%3B%20scroll-margin%3A%20initial%3B%20scroll-margin-inline%3A%20initial%3B%20scroll-padding-block%3A%20initial%3B%20scroll-padding%3A%20initial%3B%20scroll-padding-inline%3A%20initial%3B%20scroll-snap-align%3A%20initial%3B%20scroll-snap-stop%3A%20initial%3B%20scroll-snap-type%3A%20initial%3B%20shape-image-threshold%3A%20initial%3B%20shape-margin%3A%20initial%3B%20shape-outside%3A%20initial%3B%20shape-rendering%3A%20initial%3B%20size%3A%20initial%3B%20speak%3A%20initial%3B%20stop-color%3A%20initial%3B%20stop-opacity%3A%20initial%3B%20stroke%3A%20initial%3B%20stroke-dasharray%3A%20initial%3B%20stroke-dashoffset%3A%20initial%3B%20stroke-linecap%3A%20initial%3B%20stroke-linejoin%3A%20initial%3B%20stroke-miterlimit%3A%20initial%3B%20stroke-opacity%3A%20initial%3B%20stroke-width%3A%20initial%3B%20tab-size%3A%20initial%3B%20table-layout%3A%20initial%3B%20text-align%3A%20initial%3B%20text-align-last%3A%20initial%3B%20text-anchor%3A%20initial%3B%20text-combine-upright%3A%20initial%3B%20text-decoration%3A%20initial%3B%20text-decoration-skip-ink%3A%20initial%3B%20text-indent%3A%20initial%3B%20text-overflow%3A%20initial%3B%20text-shadow%3A%20initial%3B%20text-size-adjust%3A%20initial%3B%20text-transform%3A%20initial%3B%20text-underline-offset%3A%20initial%3B%20text-underline-position%3A%20initial%3B%20touch-action%3A%20initial%3B%20transform%3A%20initial%3B%20transform-box%3A%20initial%3B%20transform-origin%3A%20initial%3B%20transform-style%3A%20initial%3B%20transition%3A%20initial%3B%20user-select%3A%20initial%3B%20vector-effect%3A%20initial%3B%20vertical-align%3A%20initial%3B%20visibility%3A%20initial%3B%20-webkit-app-region%3A%20initial%3B%20border-spacing%3A%20initial%3B%20-webkit-border-image%3A%20initial%3B%20-webkit-box-align%3A%20initial%3B%20-webkit-box-decoration-break%3A%20initial%3B%20-webkit-box-direction%3A%20initial%3B%20-webkit-box-flex%3A%20initial%3B%20-webkit-box-ordinal-group%3A%20initial%3B%20-webkit-box-orient%3A%20initial%3B%20-webkit-box-pack%3A%20initial%3B%20-webkit-box-reflect%3A%20initial%3B%20-webkit-highlight%3A%20initial%3B%20-webkit-hyphenate-character%3A%20initial%3B%20-webkit-line-break%3A%20initial%3B%20-webkit-line-clamp%3A%20initial%3B%20-webkit-mask-box-image%3A%20initial%3B%20-webkit-mask%3A%20initial%3B%20-webkit-mask-composite%3A%20initial%3B%20-webkit-perspective-origin-x%3A%20initial%3B%20-webkit-perspective-origin-y%3A%20initial%3B%20-webkit-print-color-adjust%3A%20initial%3B%20-webkit-rtl-ordering%3A%20initial%3B%20-webkit-ruby-position%3A%20initial%3B%20-webkit-tap-highlight-color%3A%20initial%3B%20-webkit-text-combine%3A%20initial%3B%20-webkit-text-decorations-in-effect%3A%20initial%3B%20-webkit-text-emphasis%3A%20initial%3B%20-webkit-text-emphasis-position%3A%20initial%3B%20-webkit-text-fill-color%3A%20initial%3B%20-webkit-text-security%3A%20initial%3B%20-webkit-text-stroke%3A%20initial%3B%20-webkit-transform-origin-x%3A%20initial%3B%20-webkit-transform-origin-y%3A%20initial%3B%20-webkit-transform-origin-z%3A%20initial%3B%20-webkit-user-drag%3A%20initial%3B%20-webkit-user-modify%3A%20initial%3B%20white-space%3A%20initial%3B%20widows%3A%20initial%3B%20width%3A%20initial%3B%20will-change%3A%20initial%3B%20word-break%3A%20initial%3B%20word-spacing%3A%20initial%3B%20x%3A%20initial%3B%20y%3A%20initial%3B%20z-index%3A%20initial%3B%22%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2112641%22%20slang%3D%22en-US%22%3ERe%3A%20Network%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2112641%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F719681%22%20target%3D%22_blank%22%3E%40cgoenka%3C%2FA%3E%2C%26nbsp%3BI'm%20not%20sure%20to%20be%20honest.%20I%20wouldn't%20think%20it%20should%20through%20a%20invalid%20query%20so%20my%20guess%20is%20something%20else%20is%20going%20on%20that%20I%20didn't%20consider!%20If%20you%20want%20run%20the%20following%20query%20in%20Resource%20Graph%20Explorer%20to%20just%20verify%20the%20query%20works%20in%20your%20environment!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3EResources%0A%7C%20where%20type%20%3D~%20'Microsoft.Network%2FnetworkSecurityGroups'%0A%2F%2F%7C%20where%20id%20in~%20(%7BselectedNSG%7D)%0A%7C%20project%20name%2C%20id%2Clocation%2C%20resourceGroup%2C%20NetworkInterfaces%3Dproperties.networkInterfaces%2CSubnets%3Dproperties.subnets%2C%20SecurityRules%3Dproperties.defaultSecurityRules%2CsubscriptionId%0A%7C%20mvexpand%20SecurityRules%0A%7C%20union%20(Resources%0A%7C%20where%20type%20%3D~%20'Microsoft.Network%2FnetworkSecurityGroups'%0A%2F%2F%7C%20where%20id%20in~%20(%7BselectedNSG%7D)%0A%7C%20project%20name%2C%20id%2Clocation%2C%20resourceGroup%2C%20NetworkInterfaces%3Dproperties.networkInterfaces%2CSubnets%3Dproperties.subnets%2C%20SecurityRules%3Dproperties.securityRules%2CsubscriptionId%0A%7C%20mvexpand%20SecurityRules)%0A%7C%20join%20kind%3Dleftouter%20(ResourceContainers%0A%7C%20where%20type%20%3D%3D%20%22microsoft.resources%2Fsubscriptions%22%0A)%20on%20%24left.subscriptionId%3D%3D%24right.subscriptionId%0A%7C%20extend%20Protocol%3DSecurityRules.properties.protocol%2CDestinationAddressPrefix%3Diff(SecurityRules.properties.destinationAddressPrefix%3D%3D'%5B%5D'%2CSecurityRules.properties.destinationAddressPrefixes%2CSecurityRules.properties.destinationAddressPrefix)%2CdestinationPortRanges%3Diif(SecurityRules.properties.destinationPortRanges%3D%3D'%5B%5D'%2CSecurityRules.properties.destinationPortRange%2CSecurityRules.properties.destinationPortRanges)%2CSourceAddressPrefix%3Diif(SecurityRules.properties.sourceAddressPrefix%3D%3D'%5B%5D'%2CSecurityRules.properties.sourceAddressPrefixes%2CSecurityRules.properties.sourceAddressPrefix)%2CsourcePortRanges%3Diif(SecurityRules.properties.sourcePortRanges%3D%3D'%5B%5D'%2CSecurityRules.properties.sourcePortRange%2CSecurityRules.properties.sourcePortRanges)%2CDirection%3Dtostring(SecurityRules.properties.direction)%2CPriority%3Dtoint(SecurityRules.properties.priority)%2CAccess%3DSecurityRules.properties.access%0A%7C%20project%20Internet%3Diif((tostring(Direction)%20%3D%3D%20'Inbound'%20and%20tostring(SourceAddressPrefix)%20in%20('Internet'%2C'*')%20and%20tostring(Access)%3D%3D%22Allow%22)%2C1%2C0)%2CNSG%3Dname%2C%20Rule%3DSecurityRules.name%2C%20Subscription%3Dname1%2CResourceGroup%3DresourceGroup%2CProtocol%2CDestinationAddressPrefix%2CdestinationPortRanges%2CSourceAddressPrefix%2CsourcePortRanges%2CDirection%2CPriority%2CAccess%2CNetworkInterfaces%2CSubnets%0A%2F%2F%7C%20where%20tostring(Direction)%20%3D~%20%22%7BDirection%7D%22%20or%20'Both'%20%3D~%20'%7BDirection%7D'%0A%7C%20order%20by%20NSG%2C%20Direction%2C%20Priority%20asc%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2112231%22%20slang%3D%22en-US%22%3ERe%3A%20Network%20Security%20Group%20Monitoring%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2112231%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20workbook!%20Quick%20question%20in%20Current%20settings%20if%20a%20sub%20has%20more%20than%20300%2B%20NSGs%20will%20the%20RG%20query%20still%20work%20as%20it%20did%20not%20work%20for%20me%20for%20one%20sub%20and%20even%20for%20all%20subs%20when%20I%20select%20it%20throws%20me%20query%20invalid%20error.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎Feb 03 2021 04:51 AM
Updated by: