Detection: Ollama Suspicious Prompt Injection Jailbreak

Description

Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.

Search

 1`ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*") 
 2| rex field=_raw "\
 3|\s+(?<status_code>\d+)\s+\
 4|\s+(?<response_time>[\d\.]+[a-z]+)\s+\
 5|\s+(?<src_ip>[\:\da-f\.]+)\s+\
 6|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\"" 
 7| rex field=response_time "^(?:(?<minutes>\d+)m)?(?<seconds>[\d\.]+)s$" 
 8| eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds)) 
 9| eval src=src_ip 
10| where response_time_seconds > 30 
11| bin _time span=10m 
12| stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host 
13| where long_request_count > 170 
14| eval avg_response_time=round(avg_response_time, 2) 
15| eval max_response_time=round(max_response_time, 2) 
16| eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" ) 
17| eval attack_type="Potential Prompt Injection / Jailbreak" 
18| table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type 
19| `ollama_suspicious_prompt_injection_jailbreak_filter`

Data Source

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.

Known False Positives

Legitimate complex queries requiring extensive model reasoning, large context windows processing substantial amounts of text, batch processing operations, or resource-constrained systems experiencing performance degradation may trigger this detection during normal operations.

Associated Analytic Story

• Suspicious Ollama Activities

Risk Based Analytics (RBA)

Risk Message:

Potential prompt injection or jailbreak attempt detected from $src$ with $long_request_count$ requests averaging $avg_response_time$ seconds, indicating possible attempts to bypass AI safety controls or extract sensitive information from the Ollama model.

References

• https://github.com/rosplk/ta-ollama

• https://github.com/OWASP/www-project-ai-testing-guide

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1