I was able to correct:

securityresources 
| where type == 'microsoft.security/assessments' 
| join kind=leftouter  (resourcecontainers 
            | where type == 'microsoft.resources/subscriptions'
            | project subscriptionId, subscription=name)
        on subscriptionId
| extend resourceId = tolower(tostring(properties.resourceDetails.ResourceId))
| join kind=leftouter  (resources | project resourceId=tolower(id), rtags=tags.SystemID, resourceName=name) on resourceId
| project 
    subscription,
    resourceGroup,
    resourceType=tostring(properties.resourceDetails.ResourceType), 
    recommendationName=properties.displayName, 
    description=properties.metadata.description, 
    remediationDescription=properties.metadata.remediationDescription, 
    recommendationSeverity=properties.metadata.severity, 
    portalLink=properties.links.azurePortal,
    resourceId,
    resourceName,
    SystemID=rtags
    ```