Query: network_sg_flowlog_enabled

select
  sg.id resource,
  case
    when sg.flow_logs is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when sg.flow_logs is not null then sg.name || ' flowlog enabled.'
    else sg.name || ' flowlog disabled.'
  end as reason --
  --, sg.resource_group as resource_group
  --, sub.display_name as subscription
from
  azure_network_security_group as sg
  join azure_subscription sub on sub.subscription_id = sg.subscription_id;