Files
NetAlertX/server
mauricio-camayo 8d5eab41b5 Add pihole_monitor plugin: combined Pi-hole device import + query anomaly detection
Does two jobs against the same Pi-hole connection(s), instead of two
separately configured plugins:

1. Device import - same job as the official PIHOLEAPI (pihole_api_scan)
   plugin, but supports an optional secondary/failover Pi-hole natively
   (accepts two sets of credentials instead of forking the official
   plugin, which hardcodes its settings-key prefix and doesn't support
   multiple instances).
2. Query anomaly detection - flags a device whose blocked-query count
   spikes well above its own recent rolling average (signature of
   malware/a compromised device beaconing out), keyed by MAC address
   (not IP, which changes under DHCP) and combined across both Pi-hole
   instances so a compromised device can't evade detection by switching
   resolvers.

Notifications are delegated entirely to NetAlertX's own Watched/Report
on mechanism - the plugin never calls a notification service directly.

Live-tested against a two-Pi-hole home setup (v26.8.5) for several days,
including two real bugs found and fixed during that testing (an
offline-filtered device losing its MAC and falling back to a bare-IP
identifier, and a boolean-expression flake8 style fix).
2026-08-29 22:28:37 -05:00
..
2026-05-24 22:09:09 +10:00
2025-11-09 17:03:25 +00:00
2026-07-12 10:39:07 +10:00
2026-06-14 10:35:08 +10:00
2026-03-03 12:31:50 +00:00

NetAlertX modules

The original pilaert.py code is now moved to this new folder and split into different modules.

Module Description
__main__.py The MAIN program of NetAlertX
__init__.py an empty init file
README.md this readme file
../server/plugins a folder containing all plugins that publish notifications or scan for devices
api.py updating the API endpoints with the relevant data.
appevent.py TBC
const.py A place to define the constants for NetAlertX like log path or config path.
conf.py conf.py holds the configuration variables and makes them available for all modules. It is also the workaround for global variables that need to be resolved at some point
database.py This module connects to the DB, makes sure the DB is up to date and defines some standard queries and interfaces.
device.py The device module looks after the devices and saves the scan results into the devices
flows.py TBC
helper.py Helper as the name suggest contains multiple little functions and methods used in many of the other modules and helps keep things clean
initialise.py Initiatlise sets up the environment and makes everything ready to go
logger.py Logger is there the keep all the logs organised and looking identical.
networscan.py Networkscan collects the scan results (maybe to merge with reporting.py)
notification.py Creates and handles the notification object and generates ther HTML and text variants of the message
plugin.py This is where the plugins get integrated into the backend of NetAlertX
plugin_utils.py Helper utilities for plugin.py
reporting.py Reporting collects the data for the notification reports
scheduler.py All things scheduling