AWS Repeated CloudWatch Logs Read Operations — Detection Rule
The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.