Detects potential endpoint permission enumeration attempts in AWS EKS by a single Kubernetes identity from one IP making a burst of API calls across many resources and URLs with mixed allowed/denied outcomes. This pattern aligns with automated RBAC probing rather than normal Kubernetes operations. The rule ingests EKS control-plane audit logs via the AWS integration (logs-aws.eks_audit-*), groups events by user and source IP, and looks for a burst of verbs (get/list/watch/create/update/patch) with multiple distinct requestURIs and resources while keeping the total event count modest. Specifically, it requires: (1) two distinct authorization decisions (e.g., allow and deny) for the same user/source, (2) more than five distinct requestURIs, (3) more than three distinct objectRef.resources, and (4) a document count under 75 in the burst. This combination indicates automated RBAC probing to map what can be accessed, potentially exposing secrets, pods, nodes, or RBAC objects. The rule maps to MITRE ATT&CK Discovery techniques for container and resource discovery, reinforcing detection of enumeration behavior in Kubernetes API server audit data.