Techniques
Sample rules
Ollama Possible API Endpoint Scan Reconnaissance
- source: splunk
- technicques:
Description
Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
Detection logic
`ollama_server`
"[GIN]"
| rex field=_raw "\
|\s+(?<raw_status>\d+)\s+\
|\s+(?<raw_latency>[\d\.]+(?:µs
|ms
|s))\s+\
|\s+(?<raw_src>[^
|]+?)\s+\
|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""
| eval src=coalesce(src, trim(raw_src))
| eval uri_path=coalesce(uri_path, raw_path)
| eval http_method=coalesce(http_method, raw_method)
| eval http_response_code=coalesce(http_response_code, raw_status)
| eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000))
| where isnotnull(src) AND isnotnull(uri_path)
| bin _time span=5m
| stats count as total_requests
dc(uri_path) as distinct_endpoints
count(eval(http_method="HEAD")) as head_requests
values(uri_path) as endpoints
values(http_method) as methods
values(http_response_code) as status_codes
by _time src host
| where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0))
| eval severity="medium"
| eval attack_type="API Activity Surge"
| table _time host src total_requests
distinct_endpoints endpoints methods
status_codes severity attack_type
| `ollama_possible_api_endpoint_scan_reconnaissance_filter`