// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Source: Watching The DNS Watcher: Pihole Logs In Sentinel (2025-03-30) — https://www.hanley.cloud/2025-03-30-Watching-the-DNS-Watcher-Pihole-Logs-in-Sentinel/
// Identify the top 10 clients making DNS queries
// Platforms: Pi-hole
// Data: pihole_CL
PiHole
| summarize Count = count() by ClientIP // Aggregate counts by client IP
| top 10 by Count // Select the top 10 clients by count