Ollama Possible API Endpoint Scan Reconnaissance

name: Ollama Possible API Endpoint Scan Reconnaissance
id: ad3f352a-0347-48ee-86b9-670b5025a548
version: 6
creation_date: '2025-10-13'
modification_date: '2026-10-09'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
data_source:
    - Ollama Server
search: |-
    `ollama_server`
    "[GIN]"

    | rex field=_raw "\|\s+(?<raw_status>\d+)\s+\|\s+(?<raw_latency>[\d\.]+(?:µs|ms|s))\s+\|\s+(?<raw_src>[^|]+?)\s+\|\s+(?<raw_method>\w+)\s+\"(?<raw_path>[^\"]+)\""

    | eval src=coalesce(src, trim(raw_src))
    | eval uri_path=coalesce(uri_path, raw_path)
    | eval http_method=coalesce(http_method, raw_method)
    | eval http_response_code=coalesce(http_response_code, raw_status)
    | eval response_time_ms=coalesce(response_time_ms, case(match(raw_latency, "µs$"), tonumber(replace(raw_latency, "µs", ""))/1000, match(raw_latency, "ms$"), tonumber(replace(raw_latency, "ms", "")), match(raw_latency, "s$"), tonumber(replace(raw_latency, "s", ""))*1000))

    | where isnotnull(src) AND isnotnull(uri_path)

    | bin _time span=5m

    | stats count as total_requests
            dc(uri_path) as distinct_endpoints
            count(eval(http_method="HEAD")) as head_requests
            values(uri_path) as endpoints
            values(http_method) as methods
            values(http_response_code) as status_codes
      by _time src host

    | where total_requests > 120 AND (distinct_endpoints >= 3 OR (distinct_endpoints >= 2 AND head_requests > 0))

    | eval severity="medium"
    | eval attack_type="API Activity Surge"

    | table _time host src total_requests
            distinct_endpoints endpoints methods
            status_codes severity attack_type

    | `ollama_possible_api_endpoint_scan_reconnaissance_filter`
how_to_implement: |-
    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
known_false_positives: |-
    Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations.
references:
    - https://github.com/rosplk/ta-ollama
drilldown_searches:
    - name: View the detection results for - "$src$"
      search: |-
        %original_detection_search%
        | search src="$src$"
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$src$"
      search: |-
        from datamodel Risk.All_Risk
        | search normalized_risk_object IN ("$src$")
        | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
        | `security_content_ctime(firstTime)`
        | `security_content_ctime(lastTime)`
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: 'Possible API reconnaissance from [$src$] on [$host$] with [$total_requests$] requests across [$distinct_endpoints$] endpoints ([$endpoints$]) using methods [$methods$] and receiving status codes [$status_codes$].'
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1595
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
          sourcetype: ollama:server
          source: server.log
      test_type: unit