GitHub Repo

Detection: Splunk DoS via POST Request Datamodel Endpoint

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection is deprecated as the associated CVEs have been patched in the latest Splunk release.

Removed in version: 5.6.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-14 ID: 45766810-dbb2-44d4-b889-b4ba3ee0d1f5 Author: Rod Soto Type: Hunting Product: Splunk Enterprise Security

Description

The following is a hunting search that allows investigation of error messages indicating Splunk HTTP engine shutdown as a result of a crafted posted request against '/datamodel/model' endpoint.

1`splunkd_webs` log_level=INFO message="ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('127.0.0.1', 8065)) shut down"  
2| stats count min(_time) as firstTime max(_time) as lastTime by splunk_server message  
3| `security_content_ctime(firstTime)` 
4| `security_content_ctime(lastTime)` 
5| `splunk_dos_via_post_request_datamodel_endpoint_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
splunkd_webs index=_internal sourcetype=splunk_web_service
splunk_dos_via_post_request_datamodel_endpoint_filter ``
splunk_dos_via_post_request_datamodel_endpoint_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1499 Endpoint Denial of Service Impact

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule N/A
Earliest Time N/A
Latest Time N/A
Schedule Window N/A
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) No
Hunting detections do not generate a Finding (Notable) or Intermediate Findings (Risk Events).

Implementation

Need access to the internal indexes.

Known False Positives

This is a hunting search and will produce false positives as other causes can also shut down splunk HTTP engine, however this denial of service error is associated to a request to the datamodel/model endpoing which operator can research and find proximity of request and message in logs.

Associated Analytic Story

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation Not Applicable N/A N/A N/A
Unit Not Applicable N/A N/A N/A

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5