// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Falcon EDR. REQUIRED time picker: last 1 hour; one sensor AID, at most 100 events.
// Domain match means DNS resolution, not a confirmed callback. Pivot ContextProcessId to process telemetry.
#event_simpleName=DnsRequest aid="REPLACE_WITH_FALCON_AID"
| DomainName=/^(?:.+\.)?webhook\.site\.?$/i
| select([@timestamp, aid, ComputerName, DomainName, ContextProcessId])
| head(limit=100)