This rule detects cross-resource discovery attempts in AWS EKS audit logs by grouping Kubernetes API server get/list events across multiple resource kinds (namespaces, pods, roles, clusterroles) within 1-minute windows per user, source IP, and user agent. If three or more distinct resource types are touched in a single window, the rule flags potential reconnaissance activity (both successful and failed authorizations are included). It leverages the AWS EKS audit ingest (aws.eks.audit.*) and uses Esql to bucket by Esql.time_interval, then computes metrics such as unique_resources, enumerated_resources, and enumerated_namespaces, along with the authorization_decisions. The intent is to identify fast, broad mapping of cluster layout and RBAC exposure that commonly precedes exfiltration or privilege escalation. The rule maps to MITRE ATT&CK Discovery (T1613) and requires correlation with identities, networks, and RBAC to differentiate benign automation from adversarial probing. Setup notes indicate that the rule reads EKS control-plane audit logs from logs-aws.eks_audit-* and expects the data_stream.dataset to be aws.eks_audit with cloud.provider: aws; enabling the EKS audit log type on the cluster and routing through the AWS integration is necessary before enabling this rule.