Ollama Possible Memory Exhaustion Resource Abuse

name: Ollama Possible Memory Exhaustion Resource Abuse
id: ca96297f-e82e-4749-8cc9-d1ab555abb57
version: 5
creation_date: '2025-10-13'
modification_date: '2026-10-09'
author: Rod Soto, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.
data_source:
    - Ollama Server
search: |-
    `ollama_server`
    ("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*")

    | rex field=_raw "count=(?<runner_count>\d+)"
    | rex field=_raw "(?<memory_mb>[\d\.]+)\s+MiB"
    | rex field=_raw "started in\s*(?<load_time>[\d\.]+)\s*seconds"
    | rex field=_raw "source=(?<code_source>[^\s]+)"

    | bin _time span=5m

    | stats count as operations
            avg(load_time) as avg_load_time
            avg(memory_mb) as avg_memory
            dc(code_source) as unique_sources
            max(load_time) as max_load_time
            max(memory_mb) as max_memory
            max(runner_count) as peak_loaded_runners
            values(code_source) as code_sources
      by _time host

    | where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400

    | eval avg_memory=round(avg_memory, 2)
    | eval max_memory=round(max_memory, 2)
    | eval avg_load_time=round(avg_load_time, 2)
    | eval max_load_time=round(max_load_time, 2)
    | eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low")
    | eval attack_type="Resource Pressure / Memory Allocation"

    | table _time host operations peak_loaded_runners
            unique_sources avg_memory max_memory
            avg_load_time max_load_time severity attack_type

    | `ollama_possible_memory_exhaustion_resource_abuse_filter`
how_to_implement: |-
    Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories (sourcetype: ollama:server), or enable HTTP Event Collector (HEC) for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). CIM compatibility using the Web datamodel for standardized security detections.
known_false_positives: |-
    Legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7B+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.
references:
    - https://github.com/rosplk/ta-ollama
drilldown_searches:
    - name: View the detection results for - "$host$"
      search: |-
        %original_detection_search%
        | search host="$host$"
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$host$"
      search: |-
        from datamodel Risk.All_Risk
        | search normalized_risk_object IN ("$host$")
        | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
        | `security_content_ctime(firstTime)`
        | `security_content_ctime(lastTime)`
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: host
          type: system
          score: 20
          message: 'Ollama resource pressure indicators on [$host$]: [$peak_loaded_runners$] peak loaded runners and [$max_memory$] MiB largest observed buffer across [$operations$] log events in 5 minutes. Compare with expected workloads before escalation.'
analytic_story:
    - Suspicious Ollama Activities
asset_type: Web Application
mitre_attack_id:
    - T1499
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/ollama/server.log
          sourcetype: ollama:server
          source: server.log
      test_type: unit