Detects a single authenticated GKE (Google Kubernetes Engine) identity issuing a burst of API calls across many distinct actions and resources with mixed outcomes, a pattern consistent with automated RBAC permission enumeration rather than steady-state controller traffic. The rule aggregates GKE audit events by client.user.email and source.ip over a lookback window and alerts when more than five distinct event.action values and more than three distinct gcp.audit.resource_name values occur, while the burst contains fewer than 75 events. It requires non-anonymous, non-local source IPs. The detection targets GKE audit logs (GCP Fleet integration needed) and identifies attempts to enumerate permissions across Secrets, RBAC, pods/exec, etc. The rule outputs Esql metrics (earliest/latest timestamps, distinct counts and value lists) to facilitate triage. It maps to MITRE ATT&CK Discovery (T1613) and is labeled with medium severity and a risk score of 47. Guidance covers investigation steps (verify admin automation clients, review event_action_values/resource_name_values/outcomes, look for follow-on activity like RoleBinding changes or privileged pod operations) and remediation (revoke/rotate credentials, tighten RBAC, audit for data access post-burst). The rule’s setup note emphasizes enabling GKE audit logs via the GCP Fleet integration; a link to related Kubernetes research is provided for context.