audit_NSG_3389_internet.json

{
    "properties": {
        "mode": "All",
        "parameters": {},
        "displayName": "Audit RDP 3389 allowed from Internet",
        "description": "Audit RDP 3389 allowed from Internet",
        "metadata": {
            "category": "InfoSec Compliance"
        },
        "policyRule": {
            "if": {
                "allOf": [{
                        "field": "type",
                        "equals": "Microsoft.Network/networkSecurityGroups/securityRules"
                    },
                    {
                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/access",
                        "equals": "Allow"
                    },
                    {
                        "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction",
                        "equals": "inbound"
                    },
                    {
                        "anyOf": [{
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange",
                                "equals": "3389"
                            },
                            {
                                "not": {
                                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                                    "notEquals": "3389"
                                }
                            }
                        ]
                    },
                    {
                        "anyOf": [{
                                "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix",
                                "in": [
                                    "*",
                                    "Internet"
                                ]
                            },
                            {
                                "not": {
                                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefixes[*]",
                                    "notIn": [
                                        "*",
                                        "Internet"
                                    ]
                                }
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "audit"
            }
        }
    }
}