Query: network_watcher_flow_log_enabled

select
  sg.id resource,
  case
    when sg.enabled then 'ok'
    else 'alarm'
  end as status,
  case
    when sg.enabled then sg.name || ' flowlog enabled.'
    else sg.name || ' flowlog disabled.'
  end as reason
  
  , sg.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_network_watcher_flow_log as sg
  join azure_subscription sub on sub.subscription_id = sg.subscription_id;