legitimate automated services (ci/cd pipelines, monitoring tools, batch jobs), multiple users behind nat/proxy infrastructure, or authorized load testing activities may trigger this detection during normal operations. operator must adjust threshold accordingly.

splunk

Techniques

Sample rules

Ollama Excessive API Requests

source: splunk
technicques:

Description

Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.

Detection logic

`ollama_server`
"[GIN]"


| rex field=_raw "\
|\s+(?<raw_status>\d+)\s+\
|\s+(?<raw_latency>[\d\.]+(?:µs
|ms
|s))\s+\
|\s+(?<raw_src>[^
|]+?)\s+\
|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""


| eval src=coalesce(src, trim(raw_src))

| eval uri_path=coalesce(uri_path, raw_path)

| eval http_method=coalesce(http_method, raw_method)

| eval http_response_code=coalesce(http_response_code, raw_status)

| eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000))


| where isnotnull(src)


| bin _time span=5m


| stats count as request_count
        dc(uri_path) as distinct_endpoints
        values(uri_path) as endpoints
  by _time src


| where request_count > 120


| eval severity="medium"


| eval attack_type="High Volume API Activity"


| `ollama_excessive_api_requests_filter`