Detects a burst of Kubernetes API get requests against the secrets API in AWS EKS audit logs ingested via the AWS integration. The rule looks for multiple distinct Secret object names touched within a short lookback window by the same identity (user.name, source.ip, user_agent.original). It includes both successful and failed Get operations, since reconnaissance may occur via allowed or denied requests and failed attempts can reveal RBAC boundaries or the existence of secrets. The AWS integration streams logs under data_stream.dataset aws.eks_audit and normalizes events to aws.eks.audit. The rule filters for event action get against objectRef.resource secrets and excludes benign activity such as localhost, well known system components, and known service accounts to reduce noise. It then aggregates results by user.name, aws.eks.audit.user.username, source.ip, and user_agent.original, computing Esql.unique_credentials = count_distinct aws.eks.audit.objectRef.name, Esql.secrets_names = values aws.eks.audit.objectRef.name, Esql.namespaces = values aws.eks.audit.objectRef.namespace, Esql.event_outcome_values = values event.outcome, Esql.outcome = values aws.eks.audit.annotations.authorization_k8s_io/decision. The alert triggers when Esql.unique_credentials is greater or equal to 3, i.e., three or more distinct secrets touched by the same identity within the lookback window. When triggered, the rule preserves key identifiers such as user.name, aws.eks.audit.user.username, source.ip, user_agent.original plus the Esql fields for investigation. This pattern maps to MITRE ATT&CK T1552 unsecured credentials, specifically container API, under Credential Access, and is designed to surface credential access or in cluster reconnaissance activity in AWS EKS environments. Recommended actions include correlating the identity to RBAC scope, reviewing secrets, namespaces, and any follow on pod or RBAC changes, and if unauthorized, rotating credentials and tightening least privilege. Setup notes specify that the AWS integration ingests control plane audit logs into logs aws eks audit and that data stream aws eks audit should be present with cloud provider aws during enablement.