This rule detects an unusually high volume of AWS CloudWatch Logs read operations executed by a single AWS principal/account within a five-minute window. It focuses on API calls that read CloudWatch Logs data: DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, and GetQueryResults. The Splunk search processes CloudTrail event data to extract the user (principal), account (vendor_account), role_name, and metadata such as source IP, user agent, and region. It deduplicates events and applies a 5-minute rolling window, counting events per user/vendor_account. If the count exceeds 500, it returns a summary of the time window and associated metadata (role_name, api_operations, src, user_agent, vendor_region) and marks the event as a potential credential or access discovery/collection activity. The detection aligns with MITRE ATT&CK technique T1530 (Data from Cloud) and uses CloudTrail as the data source to identify potential automated discovery or telemetry collection from CloudWatch Logs. Known false positives include automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting that legitimately read logs at scale. Analysts should review the principal, account, source addresses, user agents, regions, and accessed CloudWatch Logs resources to determine validity before escalation. The rule assumes CloudTrail is enabled and AWS data collection is forwarded to Splunk (via the AWS Add-on).