Detection: Ollama Possible API Endpoint Scan Reconnaissance

Created: 2025-10-13 Last Updated: 2026-10-09 ID: ad3f352a-0347-48ee-86b9-670b5025a548 Author: Rod Soto, Nasreddine Bencherchali, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.

Search

 1`ollama_server`
 2"[GIN]"
 3
 4
 5| rex field=_raw "\
 6|\s+(?<raw_status>\d+)\s+\
 7|\s+(?<raw_latency>[\d\.]+(?:µs
 8|ms
 9|s))\s+\
10|\s+(?<raw_src>[^
11|]+?)\s+\
12|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""
13
14
15| eval src=coalesce(src, trim(raw_src))
16
17| eval uri_path=coalesce(uri_path, raw_path)
18
19| eval http_method=coalesce(http_method, raw_method)
20
21| eval http_response_code=coalesce(http_response_code, raw_status)
22
23| eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000))
24
25
26| where isnotnull(src) AND isnotnull(uri_path)
27
28
29| bin _time span=5m
30
31
32| stats count as total_requests
33        dc(uri_path) as distinct_endpoints
34        count(eval(http_method="HEAD")) as head_requests
35        values(uri_path) as endpoints
36        values(http_method) as methods
37        values(http_response_code) as status_codes
38  by _time src host
39
40
41| where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0))
42
43
44| eval severity="medium"
45
46| eval attack_type="API Activity Surge"
47
48
49| table _time host src total_requests
50        distinct_endpoints endpoints methods
51        status_codes severity attack_type
52
53
54| `ollama_possible_api_endpoint_scan_reconnaissance_filter`

Data Source

Name	Platform	Sourcetype	Source
Ollama Server	Other	`'ollama:server'`	`'server.log'`

Macros Used

Name	Value
ollama_server	`(sourcetype="ollama:server")`
ollama_possible_api_endpoint_scan_reconnaissance_filter	`search *`

ollama_possible_api_endpoint_scan_reconnaissance_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1595	Active Scanning	Reconnaissance

Reconnaissance

DE.AE

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.

Known False Positives

Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations.

Associated Analytic Story

Suspicious Ollama Activities

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].	src	system	20

References

https://github.com/rosplk/ta-ollama

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`server.log`	`ollama:server`
Integration	✅ Passing	Dataset	`server.log`	`ollama:server`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 6