The original DNS-level ad/tracker blocker. Lightweight, Raspberry-Pi friendly, web UI included. Same hunting signal as AdGuard — pick whichever you've already deployed.
What it watches
- DNS queries to malware / phishing / tracker domains (blocked + allowed)
- Newly-seen + DGA-pattern domains
- Lookups matching your IOC feeds
- Per-client query-volume spikes
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
7 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| dns_query | DNS query on pihole |
| dns_block | DNS query blocked on pihole |
| dns_forward | DNS forwarded query on pihole |
| dns_reply | DNS reply on pihole |
| dns_reply_error | DNS reply error on pihole |
| dns_config_error | DNS service config error on pihole |
| dns_meta | DNS service event on pihole |
What it helps you catch
What you'd see in CyberCLI
illustrativeSame IOC-hunt power as AdGuard — pick whichever you've already deployed.
Routed to Warden (triage) → Knight (detection) → Scribe (record)
⛓ every step hash-chained · replayable
What CyberCLI reads from Pi-hole
audit our mathPi-hole's query log is structurally similar to AdGuard's — every DNS query, what it asked, what came back, whether a gravity list blocked it. The 22 fields we read include the gravity-list source (which blocklist matched), the upstream resolver, response time, and client-group context. Same C2/DGA/exfil detection patterns as AdGuard with a different blocklist ecosystem.
Full field index · 22 fields ↓
.action.answer.client_ip.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.detail.event_id.event_time_raw.event_type.hostname.meta_payload.pid.program.query_name.query_type.reply_error_code.rule_level.timestamp_assumed_timezone.upstream.verb MITRE techniques typically mapped
- T1071.004 ↗
DNS C2Command and Control
- T1568.002 ↗
Domain Generation AlgorithmsCommand and Control
- T1048 ↗
Exfiltration Over Alternative ProtocolExfiltration
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest, notify, summarize
- ·L3 (Knight verification): domain reputation, DGA scoring, cross-reference with concurrent flows
- ·L4+: gravity-list edits and per-client overrides stay operator-owned
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/pihole/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
Pi-hole covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Point your network's DNS at Pi-hole.
- 2 Enable query logging.
- 3 Run `cybercli onboard pihole` and point it at the Pi-hole API / FTL.
- 4 Confirm the query stream in the dashboard's Connectors panel.
curl -sSL https://install.pi-hole.net | bash
Fully local. Pi-hole resolves + logs on your hardware; the query log stays in your network.