// Field readiness: are the fields the hunts join on actually filled? (The Tokyo Nomad, 4 Nov 2026)
// Read-only; last hour. Not executed in a live tenant; checked with Microsoft's Kusto parser against Microsoft Learn schemas.
// An empty field is a coverage gap, not a clean result. A blank percentage means the table has no such field.
// Tables you do not collect are skipped (isfuzzy); compare the output with the log checklist.
let Window = 1h;
union isfuzzy=true
    (SigninLogs | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(IPAddress)), UserAgent=countif(isnotempty(UserAgent)), Principal=countif(isnotempty(UserPrincipalName))
        | extend Source="SigninLogs"),
    (AADServicePrincipalSignInLogs | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(IPAddress)), Principal=countif(isnotempty(ServicePrincipalId))
        | extend Source="AADServicePrincipalSignInLogs", UserAgent=long(null)),
    (MicrosoftGraphActivityLogs | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(IPAddress)), UserAgent=countif(isnotempty(UserAgent)), Principal=countif(isnotempty(AppId))
        | extend Source="MicrosoftGraphActivityLogs"),
    (W3CIISLog | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(cIP)), UserAgent=countif(isnotempty(csUserAgent)), Principal=countif(isnotempty(csUserName) and csUserName != "-")
        | extend Source="W3CIISLog"),
    (AppServiceHTTPLogs | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(CIp)), UserAgent=countif(isnotempty(UserAgent)), Principal=countif(isnotempty(CsUsername) and CsUsername != "-")
        | extend Source="AppServiceHTTPLogs"),
    (AGWAccessLogs | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(ClientIp)), UserAgent=countif(isnotempty(UserAgent))
        | extend Source="AGWAccessLogs", Principal=long(null)),
    (CommonSecurityLog | where TimeGenerated > ago(Window)
        | summarize Rows=count(), ClientIP=countif(isnotempty(SourceIP)), UserAgent=countif(isnotempty(RequestClientApplication)), Principal=countif(isnotempty(SourceUserName))
        | extend Source="CommonSecurityLog")
| where Rows > 0
| extend ClientIPPct=round(100.0 * ClientIP / Rows, 1), UserAgentPct=round(100.0 * UserAgent / Rows, 1), PrincipalPct=round(100.0 * Principal / Rows, 1)
| project Source, Rows, ClientIPPct, UserAgentPct, PrincipalPct
| order by Source asc