legitimate remote access from authorized users or applications connecting from non-localhost addresses, temporary network infrastructure issues causing dns resolution failures, firewall or network configuration changes resulting in connection timeouts, cloud-hosted ollama instances receiving valid external api requests, or intermittent connectivity problems during network maintenance may trigger this detection during normal operations.

splunk

Techniques

Sample rules

Ollama Abnormal Network Connectivity

source: splunk
technicques:

Description

Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.

Detection logic

`ollama_server`
level=WARN
msg IN (
    "*connection*",
    "*dial tcp*",
    "*failed*",
    "*lookup*",
    "*network*",
    "*no such host*",
    "*refused*",
    "*timeout*",
    "*unreachable*"
)


| eval dest=coalesce(dest, host)

| bin _time span=5m

| stats count as incidents
        values(msg) as warning_messages
        latest(_time) as last_incident
  by _time dest


| where incidents > 3


| eval last_incident=strftime(last_incident, "%Y-%m-%d %H:%M:%S")


| eval severity="medium"


| eval attack_type="Abnormal Network Connectivity"


| table last_incident dest incidents warning_messages severity attack_type


| `ollama_abnormal_network_connectivity_filter`