netalertx · jokob-sk · Aug 31, 2026 · Aug 22, 2026 · Aug 22, 2026 · Aug 22, 2026
diff --git a/docs/ADVISORY_EYES_ON_GLASS.md b/docs/ADVISORY_EYES_ON_GLASS.md
@@ -24,7 +24,7 @@ Static dashboards are the enemy of real-time response. NetAlertX allows you to f
 An MSP's focus is on what is *broken*, not what is working. Hide the noise to increase reaction speed.
 
 * **Hide Unnecessary Blocks:** Under UI Settings, disable dashboard blocks that don't provide immediate utility, such as **Online presence** or **Tiles**.
-* **Hide virtual connections:** You can specify which relationships shoudl be hidden from the main view to remove any virtual devices that are not essential from your views.
+* **Hide virtual connections:** You can specify which relationships should be hidden from the main view to remove any virtual devices that are not essential from your views.
 * **Browser Full-Screen:** Use the built-in "Full Screen" toggle in the top bar to remove browser chrome (URL bars/tabs) for a cleaner "Wallboard" look.
 
 ### 3. Creating Custom NOC Views

diff --git a/docs/PIHOLE_GUIDE.md b/docs/PIHOLE_GUIDE.md
@@ -1,6 +1,6 @@
 # Integration with Pi-hole
 
-NetAlertX includes three plugins for integrating with an existing Pi-hole installation. The first plugin imports devices through the Pi-hole v6 API, the second parses the `dhcp.leases` file generated by Pi-hole, and the third reads the Pi-hole SQLite database directly. You can use any of these approaches individually or combine them with each other and other [plugins](/docs/PLUGINS.md).
+NetAlertX includes four plugins for integrating with an existing Pi-hole installation. The first plugin imports devices through the Pi-hole v6 API, the second parses the `dhcp.leases` file generated by Pi-hole, the third reads the Pi-hole SQLite database directly, and the fourth flags devices with a blocked-query spike (a common malware/compromised-device signature) and, alongside that, imports devices from one or two Pi-hole v6 instances at once. You can use any of these approaches individually or combine them with each other and other [plugins](/docs/PLUGINS.md).
 
 ## Approach 1: `PIHOLEAPI` Plugin - Import devices directly from the Pi-hole v6 API
 
@@ -75,4 +75,22 @@ Check the [PIHOLE plugin README](https://github.com/netalertx/NetAlertX/tree/mai
 
 ---
 
+## Approach 4: `PIHOLEMON` Plugin - Blocked-query anomaly detection (plus device import from one or two Pi-hole v6 instances)
+
+This plugin's main job is different from the other three above: it watches each device's own blocked-query count and flags it when that count spikes well above its recent average - a common signature of malware or a compromised device beaconing out to blocklisted domains, not just device discovery. Bundled into the same connection is a second job, the same idea as `PIHOLEAPI`'s device import, extended to a primary **and** an optional secondary/failover Pi-hole instance under one set of settings.
+
+**How it differs from `PIHOLEAPI`:**
+
+* **Anomaly detection is the point, not a bonus.** `PIHOLEAPI` only imports devices. This plugin's reason to exist is watching a device you *already* know for a sudden change in its own behavior - device import is the second, supporting job, not the main one.
+* **Two Pi-hole instances, not one.** A primary and an optional secondary/failover are both checked and their results combined under one set of settings - useful if you run more than one Pi-hole (e.g. two resolvers for redundancy) and want a single device list and a single anomaly baseline across both, instead of a blind spot on whichever instance isn't being watched.
+* **Choose `PIHOLEAPI`** if you only run one Pi-hole and just want device import - it's the simpler, more focused option. **Choose `PIHOLEMON`** if you want the anomaly detection, or run two Pi-holes needing one configuration, or both.
+
+Check the [PIHOLEMON plugin README](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/pihole_monitor/) for the full settings reference, the `http://` vs `https://` trade-off, and troubleshooting.
+
+### docker-compose changes
+
+No changes are required - this plugin only talks to Pi-hole's API, the same as `PIHOLEAPI`.
+
+---
+
 Explore other [plugins](/docs/PLUGINS.md) to discover additional information about your network, or learn how to scan [remote networks](./REMOTE_NETWORKS.md).
diff --git a/docs/PLUGINS.md b/docs/PLUGINS.md
@@ -78,6 +78,7 @@ Device-detecting plugins insert values into the `CurrentScan` database table.  T
 | `OMDSDNOPENAPI` | [omada_sdn_openapi](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/omada_sdn_openapi/)            | 📥/🆎    | OMADA TP-Link import via OpenAPI          | 🖧       |          |
 | `PIHOLE`        | [pihole_scan](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/pihole_scan/)                         | 🆎/📥 | Pi-hole device import & sync               |          |          |
 | `PIHOLEAPI`     | [pihole_api_scan](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/pihole_api_scan/)                 | 🆎/📥 | Pi-hole device import & sync via API v6+   |          |          |
+| `PIHOLEMON`     | [pihole_monitor](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/pihole_monitor/)                   | 🆎/📥 | Blocked-query anomaly detection (includes primary and secondary DNS import from Pi-hole) |          |          |
 | `PUSHSAFER`     | [_publisher_pushsafer](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/_publisher_pushsafer/)      | ▶️       | Pushsafer notifications                   |          |          |
 | `PUSHOVER`      | [_publisher_pushover](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/_publisher_pushover/)        | ▶️       | Pushover notifications                    |          |          |
 | `RSTIMPRT`      | [rest_import](https://github.com/netalertx/NetAlertX/tree/main/server/plugins/rest_import/)                        | 📥/🆎   | Import via a REST API endpoint             |  🖧      |          |

diff --git a/front/php/templates/language/de_de.json b/front/php/templates/language/de_de.json
@@ -237,7 +237,7 @@
     "Device_Shortcut_OnlineChart": "Gerätepräsenz im Laufe der Zeit",
     "Device_Shortcut_Unstable": "Instabil",
     "Device_TableHead_AlertDown": "Alarm aus",
-    "Device_TableHead_Comments": "",
+    "Device_TableHead_Comments": "Kommentare",
     "Device_TableHead_Connected_Devices": "Verbindungen",
     "Device_TableHead_CustomProps": "Eigenschaften / Aktionen",
     "Device_TableHead_FQDN": "FQDN",
@@ -908,4 +908,4 @@
     "settings_system_label": "System",
     "settings_update_item_warning": "",
     "test_event_tooltip": "Speichere die Änderungen, bevor Sie die Einstellungen testen."
-}
+}
diff --git a/front/php/templates/language/fr_fr.json b/front/php/templates/language/fr_fr.json
@@ -233,7 +233,7 @@
     "Device_Shortcut_OnlineChart": "Présence de l'appareil",
     "Device_Shortcut_Unstable": "Instable",
     "Device_TableHead_AlertDown": "Alerter si En panne",
-    "Device_TableHead_Comments": "",
+    "Device_TableHead_Comments": "Commentaires",
     "Device_TableHead_Connected_Devices": "Connexions",
     "Device_TableHead_CustomProps": "Champs / Actions",
     "Device_TableHead_FQDN": "Nom de domaine FQDN",
@@ -387,8 +387,8 @@
     "HRS_TO_KEEP_NEWDEV_name": "Supprimer les nouveaux appareils après",
     "HRS_TO_KEEP_OFFDEV_description": "Il s'agit d'un paramètre de maintenance <b>SUPPRIMER des appareils</b>. Si cette option est activée (<code>0</code> est désactivé), les appareils qui sont <b>Hors ligne</b> et dont la <b>dernière connexion</b> est plus ancienne que les heures spécifiées dans ce paramètre. Utilisez ce paramètre si vous souhaitez supprimer automatiquement <b>Appareils hors ligne</b> après <code>X</code> heures de déconnexion.",
     "HRS_TO_KEEP_OFFDEV_name": "Supprimez les appareils hors ligne après",
-    "Header_PauseScans_Tooltip": "",
-    "Header_ResumeScans_Tooltip": "",
+    "Header_PauseScans_Tooltip": "Mettre en pause les scans automatiques",
+    "Header_ResumeScans_Tooltip": "Reprendre les scans automatiques",
     "LOADED_PLUGINS_description": "Affiche les plugins chargés. Ajouter des plugins peut ralentir l'application. Obtenez plus d'informations dur quels plugins dont à activer, ou les options de scan dans la <a target=\"_blank\" href=\"https://docs.netalertx.com/PLUGINS\">documentation des plugins</a>. Décharger des plugins leur fait perdre leurs paramètres. Seuls les plugins <code>désactivés</code> peuvent être déchargés.",
     "LOADED_PLUGINS_name": "Plugins chargés",
     "LOG_LEVEL_description": "Ce paramètre active une journalisation dans les logs plus verbeuse. Cela est utile pour identifier les événements écrivant dans la base de données.",
@@ -647,8 +647,8 @@
     "SCAN_SUBNETS_description": "La plupart des scanners sur le réseau (scan ARP, NMAP, Nslookup, DIG) se base sur le scan d'une partie spécifique des interfaces réseau ou de sous-réseau. Consulter la <a href=\"https://docs.netalertx.com/SUBNETS\" target=\"_blank\">documentation des sous-réseaux</a> pour plus d'aide sur ce paramètre, notamment pour des VLAN, lesquels sont supportés ou sur comment identifier le masque réseau et votre interface réseau. <br/> <br/> Une alternative à ces scanner sur le réseau et d'activer d'autres scanners d'appareils ou des importe, qui ne dépendent pas du fait de laisser NetAlert<sup>X</sup> accéder au réseau (Unifié, baux DHCP, Pi-hole, etc.).<br/><br/> Remarque : la durée du scan en lui-même dépend du nombre d'adresses IP à scanner, renseignez donc soigneusement avec le bon masque réseau et la bonne interface réseau.",
     "SCAN_SUBNETS_name": "Réseaux à scanner",
     "SYSTEM_TITLE": "Informations système",
-    "Scans_Paused": "",
-    "Scans_Resumed": "",
+    "Scans_Paused": "Scans mis en pause",
+    "Scans_Resumed": "Scans repris",
     "Setting_Override": "Remplacer la valeur",
     "Setting_Override_Description": "Activer cette option va remplacer la valeur fournie par défaut par une application par la valeur renseignée au-dessus.",
     "Settings_Metadata_Toggle": "Afficher/masquer les méta données pour le paramètre sélectionné.",
@@ -835,4 +835,4 @@
     "settings_system_label": "Système",
     "settings_update_item_warning": "Mettre à jour la valeur ci-dessous. Veillez à bien suivre le même format qu'auparavant. <b>Il n'y a pas de pas de contrôle.</b>",
     "test_event_tooltip": "Enregistrer d'abord vos modifications avant de tester vôtre paramétrage."
-}
+}
diff --git a/front/php/templates/language/it_it.json b/front/php/templates/language/it_it.json
@@ -233,7 +233,7 @@
     "Device_Shortcut_OnlineChart": "Presenza dispositivo",
     "Device_Shortcut_Unstable": "Instabile",
     "Device_TableHead_AlertDown": "Avviso disconnessione",
-    "Device_TableHead_Comments": "",
+    "Device_TableHead_Comments": "Commenti",
     "Device_TableHead_Connected_Devices": "Connessioni",
     "Device_TableHead_CustomProps": "Proprietà/Azioni",
     "Device_TableHead_FQDN": "FQDN",
@@ -387,8 +387,8 @@
     "HRS_TO_KEEP_NEWDEV_name": "Elimina nuovi dispositivi dopo",
     "HRS_TO_KEEP_OFFDEV_description": "Questa è un'impostazione di manutenzione che <b>ELIMINA dispositivi</b>. Se abilitata (<code>0</code> è disabilitata), i dispositivi <b>Offline</b> la cui data e ora di <b>Ultima connessione</b> sono antecedenti alle ore specificate in questa impostazione, verranno eliminati. Utilizza questa impostazione se vuoi eliminare automaticamente i <b>Dispositivi offline</b> dopo <code>X</code> ore trascorse offline.",
     "HRS_TO_KEEP_OFFDEV_name": "Elimina dispositivi offline dopo",
-    "Header_PauseScans_Tooltip": "",
-    "Header_ResumeScans_Tooltip": "",
+    "Header_PauseScans_Tooltip": "Scansioni automatiche in pausa",
+    "Header_ResumeScans_Tooltip": "Riprendi scansioni automatiche",
     "LOADED_PLUGINS_description": "Quali Plugin caricare. L'aggiunta di plugin potrebbe rallentare l'applicazione. Leggi di più su quali plugin necessitano di essere abilitati, tipi e opzioni di scansione nella <a target=\"_blank\" href=\"https://docs.netalertx.com/PLUGINS\">documentazione plugin</a>. I plugin disinstallati perdono la loro configurazione. Solo i plugin <code>disabilitati</code> possono essere disinstallati.",
     "LOADED_PLUGINS_name": "Plugin caricati",
     "LOG_LEVEL_description": "Questa impostazione abilita un log più dettagliato. Utile per il debug degli eventi salvati nel database.",
@@ -647,8 +647,8 @@
     "SCAN_SUBNETS_description": "La maggior parte degli scanner di rete (ARP-SCAN, NMAP, NSLOOKUP, DIG) si basano sulla scansione di interfacce di rete e sottoreti specifiche. Consulta la <a href=\"https://docs.netalertx.com/SUBNETS\" target=\"_blank\">documentazione sulle sottoreti</a> per assistenza su questa impostazione, in particolare VLAN, quali VLAN sono supportate o come individuare la maschera di rete e l'interfaccia. <br/> <br/> Un'alternativa agli scanner in rete è abilitare altri scanner/importatori di dispositivi che non si affidano a NetAlert<sup>X</sup> che hanno accesso alla rete (UNIFI, dhcp.leases , PiHole, ecc.). <br/> <br/> Nota: il tempo di scansione stesso dipende dal numero di indirizzi IP da controllare, quindi impostalo attentamente con la maschera di rete e l'interfaccia appropriate.",
     "SCAN_SUBNETS_name": "Reti da scansionare",
     "SYSTEM_TITLE": "Informazioni sistema",
-    "Scans_Paused": "",
-    "Scans_Resumed": "",
+    "Scans_Paused": "Scansioni in pausa",
+    "Scans_Resumed": "Scansioni riprese",
     "Setting_Override": "Sovrascrivi valore",
     "Setting_Override_Description": "L'abilitazione di questa opzione sovrascriverà il valore predefinito fornito dall'app con il valore specificato sopra.",
     "Settings_Metadata_Toggle": "Mostra/nascondi i metadati per l'impostazione specificata.",
@@ -835,4 +835,4 @@
     "settings_system_label": "Sistema",
     "settings_update_item_warning": "Aggiorna il valore qui sotto. Fai attenzione a seguire il formato precedente. <b>La convalida non viene eseguita.</b>",
     "test_event_tooltip": "Salva le modifiche prima di provare le nuove impostazioni."
-}
+}