Cluster admin token use from external IP followed by bulk secrets reads
Detects a single external source IP reading secrets and configmaps across multiple Kubernetes namespaces in bulk within a 1-hour window, which may indicate reconnaissance or credential theft.
Microsoft Sentinel (KQL)
