Detection: Ollama Excessive API Requests

Description

Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.

Search

 1`ollama_server`
 2"[GIN]"
 3
 4
 5| rex field=_raw "\
 6|\s+(?<raw_status>\d+)\s+\
 7|\s+(?<raw_latency>[\d\.]+(?:µs
 8|ms
 9|s))\s+\
10|\s+(?<raw_src>[^
11|]+?)\s+\
12|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""
13
14
15| eval src=coalesce(src, trim(raw_src))
16
17| eval uri_path=coalesce(uri_path, raw_path)
18
19| eval http_method=coalesce(http_method, raw_method)
20
21| eval http_response_code=coalesce(http_response_code, raw_status)
22
23| eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000))
24
25
26| where isnotnull(src)
27
28
29| bin _time span=5m
30
31
32| stats count as request_count
33        dc(uri_path) as distinct_endpoints
34        values(uri_path) as endpoints
35  by _time src
36
37
38| where request_count > 120
39
40
41| eval severity="medium"
42
43
44| eval attack_type="High Volume API Activity"
45
46
47| `ollama_excessive_api_requests_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.

Known False Positives

Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.

Associated Analytic Story

• Suspicious Ollama Activities

Intermediate Findings

References

• https://github.com/rosplk/ta-ollama

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5