Detects rapid cross-resource discovery activity in GKE clusters by monitoring GKE audit get/list events across a defined set of Kubernetes resources (namespaces, nodes, pods, configmaps, serviceaccounts, roles, rolebindings, clusterroles, clusterrolebindings) within a one-minute window per client (identified by client.user.email, source.ip, and user_agent.original). An alert fires when five or more distinct resource kinds are touched and the burst includes both cluster-layout kinds (namespaces, pods, nodes) and RBAC kinds. The rule accounts for both allowed and denied authorizations, recognizing probing behavior during reconnaissance. It helps distinguish routine automation from potential discovery ahead of exfiltration or privilege escalation. Output includes the enumerated resources and names, along with the associated client, IP, and user agent metadata. Alert suppression groups by client.user.email and source.ip for 30 minutes to reduce noise from repeated automation. This rule is mapped to MITRE ATT&CK technique T1613 (Container and Resource Discovery) under the Discovery tactic. It includes triage guidance (verify enumerated_resources/namespaces/resource_names, check expected admin/automation clients, correlate with subsequent secrets or RBAC changes), false positive considerations (platform sync jobs or predefined scans; advise exclusions after validation), and remediation steps (revoke/rotate credentials, tighten RBAC, inspect for unauthorized access or persistence). The setup notes require the GCP Fleet integration with GKE audit logs to be enabled for compatibility.