// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: Watching The DNS Watcher: Pihole Logs In Sentinel (2025-03-30) — https://www.hanley.cloud/2025-03-30-Watching-the-DNS-Watcher-Pihole-Logs-in-Sentinel/
// Platforms: Pi-hole
// Data: pihole_CL
// Summarize the count of blocked DNS queries over time
PiHole
| where QueryType == "Blocked" // Filter for blocked queries
| summarize Count = count() by bin(TimeGenerated, 1h) // Aggregate counts in 1-hour intervals
| render timechart // Visualize the data as a time chart