kustoopen-nsgs.kqlazuresecuritykql

Azure Resource Graph — open NSGs

Find NSG rules that allow inbound from the internet on sensitive ports.

August 12, 2026

Paste into Azure Resource Graph Explorer. Tune sensitivePorts for your environment.

Resources
| where type =~ "microsoft.network/networksecuritygroups"
| mv-expand rule = properties.securityRules
| extend
    access = tostring(rule.properties.access),
    direction = tostring(rule.properties.direction),
    prefix = tostring(rule.properties.sourceAddressPrefix),
    prefixes = rule.properties.sourceAddressPrefixes,
    destPort = tostring(rule.properties.destinationPortRange),
    destPorts = rule.properties.destinationPortRanges
| where access =~ "Allow" and direction =~ "Inbound"
| where prefix in ("*", "Internet", "0.0.0.0/0")
    or array_length(set_intersect(prefixes, dynamic(["*", "Internet", "0.0.0.0/0"]))) > 0
| extend sensitivePorts = dynamic(["22", "3389", "1433", "3306", "5432"])
| where destPort in (sensitivePorts)
    or array_length(set_intersect(destPorts, sensitivePorts)) > 0
| project
    nsg = id,
    rule = tostring(rule.name),
    prefix,
    destPort,
    destPorts,
    subscriptionId