Detects anomalous bulk retrieval of AWS Secrets Manager secrets via BatchGetSecretValue within a 1-hour window. The rule flags a single AWS principal (vendor_account and user_arn) performing more than 10 distinct successful BatchGetSecretValue calls in one hour, deduplicating events by eventID to avoid duplicates. It ingests AWS CloudTrail events for secretsmanager.amazonaws.com, extracts user identity (ARN) and account, and uses a 1-hour rolling window to identify bursts. When a burst is detected, it reports the first and last times, counts the batch requests, and returns associated source IPs, user agents, and AWS region. The resulting finding flags the identity as potentially compromised or misused and maps to credential access risk (MITRE T1555.006). The rule supports cloud security monitoring with Splunk products and is intended to alert on possible AWS identity takeover while acknowledging legitimate automation may occasionally trigger false positives. This detection is supported by a true positive test dataset and is designed to be reviewed for authorization context, source IP, user agent, account, region, and requested secret identifiers if triggered.