legitimate automated services (ci/cd pipelines, monitoring tools, batch jobs), multiple users behind nat/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. operator must adjust threshold accordingly.

Techniques

T1498

Sample rules

Ollama Excessive API Requests

source: splunk
technicques:
- T1498

Description

Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.

Detection logic

`ollama_server` 
| rex field=_raw "\
|\s+(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\
|" 
| eval src=coalesce(src, client_ip) 
| eval dest=coalesce(dest, url, uripath, endpoint) 
| bin _time span=5m 
| stats count as request_count by _time, src, dest, host 
| where request_count > 120 
| eval severity="high" 
| eval attack_type="Rate Limit Abuse / DDoS" 
| stats count by _time, host, src, dest, request_count, severity, attack_type 
| `ollama_excessive_api_requests_filter`