// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Identify the top 10 blocked domains
// Source: Watching The DNS Watcher: Pihole Logs In Sentinel (2025-03-30) — https://www.hanley.cloud/2025-03-30-Watching-the-DNS-Watcher-Pihole-Logs-in-Sentinel/
// Platforms: Pi-hole
// Data: pihole_CL
PiHole
| where QueryType == "Blocked" // Filter for blocked queries
| summarize Count = count() by Domain // Aggregate counts by domain
| top 10 by Count // Select the top 10 domains by count