Network Security Group Monitoring

Great workbook! Quick question in Current settings if a sub has more than 300+ NSGs will the RG query still work as it did not work for me for one sub and even for all subs when I select it throws me query invalid error.

cgoenka, I'm not sure to be honest. I wouldn't think it should through a invalid query so my guess is something else is going on that I didn't consider! If you want run the following query in Resource Graph Explorer to just verify the query works in your environment!

Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.defaultSecurityRules,subscriptionId
| mvexpand SecurityRules
| union (Resources
| where type =~ 'Microsoft.Network/networkSecurityGroups'
//| where id in~ ({selectedNSG})
| project name, id,location, resourceGroup, NetworkInterfaces=properties.networkInterfaces,Subnets=properties.subnets, SecurityRules=properties.securityRules,subscriptionId
| mvexpand SecurityRules)
| join kind=leftouter (ResourceContainers
| where type == "microsoft.resources/subscriptions"
) on $left.subscriptionId==$right.subscriptionId
| extend Protocol=SecurityRules.properties.protocol,DestinationAddressPrefix=iff(SecurityRules.properties.destinationAddressPrefix=='[]',SecurityRules.properties.destinationAddressPrefixes,SecurityRules.properties.destinationAddressPrefix),destinationPortRanges=iif(SecurityRules.properties.destinationPortRanges=='[]',SecurityRules.properties.destinationPortRange,SecurityRules.properties.destinationPortRanges),SourceAddressPrefix=iif(SecurityRules.properties.sourceAddressPrefix=='[]',SecurityRules.properties.sourceAddressPrefixes,SecurityRules.properties.sourceAddressPrefix),sourcePortRanges=iif(SecurityRules.properties.sourcePortRanges=='[]',SecurityRules.properties.sourcePortRange,SecurityRules.properties.sourcePortRanges),Direction=tostring(SecurityRules.properties.direction),Priority=toint(SecurityRules.properties.priority),Access=SecurityRules.properties.access
| project Internet=iif((tostring(Direction) == 'Inbound' and tostring(SourceAddressPrefix) in ('Internet','*') and tostring(Access)=="Allow"),1,0),NSG=name, Rule=SecurityRules.name, Subscription=name1,ResourceGroup=resourceGroup,Protocol,DestinationAddressPrefix,destinationPortRanges,SourceAddressPrefix,sourcePortRanges,Direction,Priority,Access,NetworkInterfaces,Subnets
//| where tostring(Direction) =~ "{Direction}" or 'Both' =~ '{Direction}'
| order by NSG, Direction, Priority asc

Well done!!  Super helpful.  Thank you sir!

cgoenka could you try just selecting a couple NSGs and see if the workbook renders it correctly. I'm thinking that it could possibly be the below part of the query. In the workbook it's not commented. If we verify that's the cause I'll look at a different way to filter it.

//| where id in~ ({selectedNSG})

Hello bwatts670, 
I am getting hung up on the creation of the 'diagnostic setting' does this have to be performed per NSG? In order to send the 'Activity Logs' to the 'Log Analytics Workspace'? 

What about new NSG's? Does this have to be performed every time an NSG is created?

Thanks!

Edit:
I figured out I just didn't read far enough. You can create a policy to create diagnostic settings for each NSG as they are created, with a remediation task which will go back and apply the policy to all existing assets. 
https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD

I cant save, getting this error, any ideas?

Details
The blade Extension/AppInsightsExtension/Blade/UsageNotebookBlade failed to supply all the required parameters. The missing the required parameter(s) 'subscriptionId'.