Detects the first observed failed GKE API request originating from a previously unseen user agent. Adversaries often use non-standard clients when probing RBAC or attempting exploitation in Kubernetes clusters. The rule targets failures where a new, unrecognized user_agent.original signals potential reconnaissance, config drift, or post-exploitation tooling interacting with the Kubernetes API. It relies on the GCP audit logs (gcp.audit dataset) and filters for event.outcome: failure while excluding known Kubernetes components (e.g., kubernetes Format, kube-probe, gke-exec-auth-plugin) and service.user/email matches to trusted accounts. The rule flags the first occurrence via the new_terms history mechanism, capturing the field user_agent.original with a history window of now-7d. The intent is to surface RBAC probing or unauthorized API access attempts early, especially when paired with authorization failures. It supports triage by correlating user_agent.original with client.email, event.action, resource_name, and source IP to distinguish novel tools from legitimate new clients. False positives may include legitimate new tooling or CI runners; those should be reviewed and, if validated, added as scoped UA exceptions. The rule has a medium risk posture with a 47 risk score.