Techniques
Sample rules
Ollama Long-Running Inference Requests
- source: splunk
- technicques:
Description
Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions. Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal.
Detection logic
`ollama_server`
"[GIN]"
| rex field=_raw "\
|\s+(?<raw_status>\d+)\s+\
|\s+(?<raw_latency>(?:\d+h)?(?:\d+m)?[\d\.]+(?:µs
|ms
|s))\s+\
|\s+(?<raw_src>[^
|]+?)\s+\
|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""
| eval src=coalesce(src, trim(raw_src))
| eval uri_path=mvindex(split(coalesce(uri_path, raw_path), "?"), 0)
| eval http_method=coalesce(http_method, raw_method)
| eval http_response_code=coalesce(http_response_code, raw_status)
| rex field=raw_latency "^(?:(?<raw_latency_hours>\d+)h)?(?:(?<raw_latency_minutes>\d+)m)?(?<raw_latency_value>[\d\.]+)(?<raw_latency_unit>µs
|ms
|s)$"
| eval response_time_ms=(coalesce(tonumber(raw_latency_hours), 0) * 3600000) + (coalesce(tonumber(raw_latency_minutes), 0) * 60000) + (tonumber(raw_latency_value) * case(raw_latency_unit="µs", 0.001, raw_latency_unit="ms", 1, raw_latency_unit="s", 1000))
| where isnotnull(src) AND in(uri_path, "/api/generate", "/api/chat", "/v1/chat/completions") AND response_time_ms > 30000
| eval response_time_seconds=response_time_ms/1000
| bin _time span=10m
| stats count as long_request_count
avg(response_time_seconds) as avg_response_time
max(response_time_seconds) as max_response_time
values(uri_path) as uri_path
values(http_response_code) as status_codes
by _time src host
| where long_request_count > 1
| eval avg_response_time=round(avg_response_time, 2)
| eval max_response_time=round(max_response_time, 2)
| eval severity=case(max_response_time > 55, "high", 1=1, "medium")
| eval attack_type="Long-Running Inference Requests"
| table _time host src uri_path long_request_count
avg_response_time max_response_time
status_codes severity attack_type
| `ollama_long_running_inference_requests_filter`
Ollama Suspicious Prompt Injection Jailbreak
- source: splunk
- technicques:
Description
Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.
Detection logic
`ollama_server` "GIN" ("*/api/generate*" OR "*/v1/chat/completions*")
| rex field=_raw "\
|\s+(?<status_code>\d+)\s+\
|\s+(?<response_time>[\d\.]+[a-z]+)\s+\
|\s+(?<src_ip>[\:\da-f\.]+)\s+\
|\s+(?<http_method>\w+)\s+\"(?<uri_path>[^\"]+)\""
| rex field=response_time "^(?:(?<minutes>\d+)m)?(?<seconds>[\d\.]+)s$"
| eval response_time_seconds=if(isnotnull(minutes), tonumber(minutes)*60+tonumber(seconds), tonumber(seconds))
| eval src=src_ip
| where response_time_seconds > 30
| bin _time span=10m
| stats count as long_request_count, avg(response_time_seconds) as avg_response_time, max(response_time_seconds) as max_response_time, values(uri_path) as uri_path, values(status_code) as status_codes by _time, src, host
| where long_request_count > 170
| eval avg_response_time=round(avg_response_time, 2)
| eval max_response_time=round(max_response_time, 2)
| eval severity=case( long_request_count > 50 OR max_response_time > 55, "critical", long_request_count > 20 OR max_response_time > 40, "high", 1=1, "medium" )
| eval attack_type="Potential Prompt Injection / Jailbreak"
| table _time, host, src, uri_path, long_request_count, avg_response_time, max_response_time, status_codes, severity, attack_type
| `ollama_suspicious_prompt_injection_jailbreak_filter`