Query: network_firewall_unrestricted_inbound_rules_count

with inbound_fw as (
  select
    id
  from
    digitalocean_firewall,
    jsonb_array_elements(inbound_rules) as i
  where
    i -> 'sources' -> 'addresses' = '["0.0.0.0/0","::/0"]'
    and i ->> 'protocol' <> 'icmp'
    group by id
)
select
  'Unrestricted Inbound (Excludes ICMP)' as label,
  count(*) as value,
  case
    when count(*) = 0 then 'ok'
    else 'alert'
  end as type
from
  inbound_fw;