Pi-hole
new-or-rarely-seen-domains.kql
Domains seen in the last 24h that haven't been seen recently — a classic new-domain-observed hunt.
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
//New or Rarely Seen Domains
let cutoff = ago(24h);
let recent = pihole_CL
| where TimeGenerated > cutoff
| summarize count() by DnsQuery_s;
let historic = pihole_CL
| where TimeGenerated <= cutoff
| summarize count() by DnsQuery_s;
recent
| join kind=leftanti historic on DnsQuery_s
| top 20 by count_
// Alternate query:
// Identify domains that have been queried for the first time or are rarely seen
PiHole
| summarize Count = count(), FirstSeen = min(TimeGenerated) by Domain // Aggregate counts and first seen time by domain
| where Count < 5 // Filter for domains queried less than 5 times
| order by FirstSeen desc // Order by the first seen time in descending order