Detects Azure AKS (Kubernetes) API enumeration by a single identity through breadth of 403 Forbidden responses across multiple distinct Kubernetes resource types within a short window. The rule analyzes kube-audit events ingested via azure.platformlogs, grouping forbidden (HTTP 403) calls by the user identity and the resource type denied. It triggers when an identity is denied across at least four distinct resource types within a five-minute interval (lookback window of nine minutes). This breadth-based signal targets reconnaissance using a stolen service account token, as opposed to noise from a single-resource retry loop. The setup requires the Azure Fleet integration routing AKS diagnostic logs into azure.platformlogs with kube-audit categorization; excluding certain known service accounts reduces false positives. The rule maps to MITRE ATT&CK technique T1613 (Container and Resource Discovery) under the Discovery tactic, aligning with the behavior of probing what resources a credential can reach and potentially escalating privileges. Triage and investigation guidance (highlights): identify the identity and groups, inspect the denied resources and verbs, review the source IP and userAgent, and correlate with sign-ins and RBAC bindings. False positives include workloads or agents with partial RBAC, which should be baselined or excluded after review. Remediation involves revoking tokens, reviewing RBAC bindings, and collecting audit artifacts for IR.