detection.wiki

Detection rules › Splunk

Ollama Excessive API Requests

Status
experimental
Severity
low
Group by
_time, attack_type, dest, host, request_count, severity, src
Author
Rod Soto
Source
github.com/splunk/security_content

Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.

Known false positives

  • Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.

MITRE ATT&CK coverage

TacticTechniques
Impact

Rule body

name: Ollama Excessive API Requests
id: 1cfab663-9adc-4169-a88c-6bae29ba3c70
version: 4
creation_date: '2025-10-13'
modification_date: '2026-05-13'
author: Rod Soto
status: experimental
type: Anomaly
description: Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.
data_source:
    - Ollama Server
search: '`ollama_server` | rex field=_raw "\|\s+(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|" | eval src=coalesce(src, client_ip) | eval dest=coalesce(dest, url, uripath, endpoint) | bin _time span=5m | stats count as request_count by _time, src, dest, host | where request_count > 120 | eval severity="high" | eval attack_type="Rate Limit Abuse / DDoS" | stats count by _time, host, src, dest, request_count, severity, attack_type | `ollama_excessive_api_requests_filter`'
how_to_implement: 'Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.'
known_false_positives: Legitimate automated services (CI/CD pipelines, monitoring tools, batch jobs), multiple users behind NAT/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. Operator must adjust threshold accordingly.
references:
    - https://github.com/rosplk/ta-ollama
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: Possible DDoS attack from $src$ against Ollama server detected with request count $request_count$ in 1 minute, potentially causing service degradation or complete unavailability.
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1498
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

Stages and Predicates

Stage 1: search

`ollama_server`

Stage 2: rex

| rex field=_raw "\|\s+(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\|"

Stage 3: eval

| eval src=coalesce(src, client_ip)

Stage 4: eval

| eval dest=coalesce(dest, url, uripath, endpoint)

Stage 5: bucket

| bin _time span=5m

Stage 6: stats

| stats count as request_count by _time, src, dest, host

Stage 7: where

| where request_count > 120

Stage 8: eval

| eval severity="high"

Stage 9: eval

| eval attack_type="Rate Limit Abuse / DDoS"

Stage 10: stats

| stats count by _time, host, src, dest, request_count, severity, attack_type

Stage 11: search

| `ollama_excessive_api_requests_filter`

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
request_countgt
  • 120
field:"request_count" kind:gt value:"120"
sourcetypeeq
  • ollama:server
field:"sourcetype" kind:eq value:"ollama:server"