The GKE Anonymous Endpoint Permission Enumeration rule detects bursts of API probe activity against a Google Kubernetes Engine (GKE) cluster performed by anonymous identities. It analyzes GCP audit logs (dataset gcp.audit) for events where client.user.email is either null or equals system:anonymous or system:unauthenticated, across API calls to the Kubernetes API (service.name == k8s.io). It excludes benign readiness and health endpoints (readyz, livez, healthz, version). The rule aggregates events by source IP over a rolling window, collecting counts of documents, failures, distinct actions, and distinct resource names, along with the lists of actions/resources and client user emails observed. A valid alert requires more than five distinct actions and more than three distinct resources, at least one failure, and a relatively small number of documents (to avoid noisy telemetry). The detection yields Esql metrics such as Esql.document_count, Esql.failure_count, Esql.event_action_count_distinct, Esql.resource_name_count_distinct, and captures Esql.event_action_values, Esql.resource_name_values, Esql.event_outcome_values, Esql.client_user_email_values, and related metadata. It maps to MITRE ATT&CK Discovery and Reconnaissance techniques (T1613 Container and Resource Discovery; T1595 Active Scanning, including subtechnique T1595.003 Wordlist Scanning). The rule is intended to surface anonymous reconnaissance attempts prior to credential theft or exploitation and should be used in environments with publicly exposed GKE endpoints. The integration requires GCP Fleet with GKE audit logs enabled. References point to Kubernetes audit docs. Keywords: GKE, anonymous, permission enumeration, audit logs, reconnaissance.