Does two jobs against the same Pi-hole connection(s), instead of two
separately configured plugins:
1. Device import - same job as the official PIHOLEAPI (pihole_api_scan)
plugin, but supports an optional secondary/failover Pi-hole natively
(accepts two sets of credentials instead of forking the official
plugin, which hardcodes its settings-key prefix and doesn't support
multiple instances).
2. Query anomaly detection - flags a device whose blocked-query count
spikes well above its own recent rolling average (signature of
malware/a compromised device beaconing out), keyed by MAC address
(not IP, which changes under DHCP) and combined across both Pi-hole
instances so a compromised device can't evade detection by switching
resolvers.
Notifications are delegated entirely to NetAlertX's own Watched/Report
on mechanism - the plugin never calls a notification service directly.
Live-tested against a two-Pi-hole home setup (v26.8.5) for several days,
including two real bugs found and fixed during that testing (an
offline-filtered device losing its MAC and falling back to a bare-IP
identifier, and a boolean-expression flake8 style fix).
mauricio-camayo
8d5eab41b5