from * metadata _id, _index, _version | where operationName=="MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE" and status=="Success" and requestBody like "*\"direction\":\"Inbound\"*" and requestBody like "*\"access\":\"Allow\"*" and (requestBody like "*\"sourceAddressPrefix\":\"\*\"*" or requestBody like "*\"sourceAddressPrefix\":\"Internet\"*" or requestBody like "*\"sourceAddressPrefix\":\"Any\"*" or requestBody like "*\"sourceAddressPrefix\":\"0.0.0.0/0\"*")
