Splunk

Ollama Possible API Endpoint Scan Reconnaissance

Last updated 2 days ago on 2026-07-17

About

Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.

Platform: Splunk
Tags: Data Source: SplunkDomain: ApplicationRule Type: QueryOS: Any
Severity: medium
Risk Score: 47
References: https://github.com/rosplk/ta-ollama(external, opens in a new tab or window)
False Positives: Legitimate web application clients or mobile apps that access multiple API endpoints as part of normal functionality, monitoring and health check systems probing various endpoints for availability, load balancers performing health checks across different paths, API testing frameworks during development and QA processes, or users navigating through web interfaces that trigger multiple API calls may generate similar patterns during normal operations.
Source: View on GitHub(external, opens in a new tab or window)

Definition

Rule Language: SPL
Rule Type: query

✄𐘗text code block:
✄𐘗`ollama_server` "[GIN]"
  | bin _time span=5m
  | stats count as total_requests, values(dest) as dest, values(http_method) as methods, values(status) as status_codes
    BY _time, src, host
  | where total_requests > 120
  | eval severity="medium"
  | eval attack_type="API Activity Surge"
  | stats count
    BY _time, host, src,
       total_requests, dest, methods,
       status_codes, severity, attack_type
  | `ollama_possible_api_endpoint_scan_reconnaissance_filter`

View this rule on Splunk

This rule was sourced from the official Splunk public repository. View the original rule on GitHub(external, opens in a new tab or window).