AWS Discovery Commands Executed from Instance Profile

let timeframe = 2*1h;
let lookback = 4h;
let RuleId = "0239";
let DedupFields = dynamic(["TimeGenerated"]);
let actionsThreshold = 4;
let serviceAccessThreshold =  3;
AWSCloudTrail
| where ingestion_time() >= ago(timeframe)
| where UserIdentityPrincipalid contains_cs ":i-"
| where EventName in~("DescribeInstances","DescribeSnapshots","DescribeTrails","GetAccountAuthorizationDetails","GetAccountSummary","GetCallerIdentity","GetSecretValue","ListAssociations","ListBuckets","ListDetectors","ListGroups","ListRoles","ListUsers") or EventSource startswith "secretsmanager."
| extend Target_instance_id = tostring(parse_json(tostring(parse_json(tostring(parse_json(RequestParameters).instancesSet)).items))[0].instanceId)
| extend Source_instance_id = tostring(split(UserIdentityArn, "/")[-1])
| where not(Source_instance_id == Target_instance_id and EventName =~ "DescribeInstances")
| summarize make_set(EventName), DistinctRequests = dcount(EventName), AccessedServices = dcount(EventSource), CountEvents = count() by UserIdentityArn, bin(TimeGenerated, lookback), SourceIpAddress
| where DistinctRequests >= actionsThreshold and AccessedServices >= serviceAccessThreshold
// Begin environment-specific filter.
// End environment-specific filter.
// Begin de-duplication logic.
| extend DedupFieldValues=pack_all()
| mv-apply e=DedupFields to typeof(string) on (
    extend DedupValue=DedupFieldValues[tostring(e)]
| order by e // Sorting is required to ensure make_list is deterministic.
| summarize DedupValues=make_list(DedupValue)
)
| extend DedupEntity=strcat_array(DedupValues, "
| ")
| project-away DedupFieldValues, DedupValues
| join kind=leftanti (
    SecurityAlert
| where AlertName has RuleId and ProviderName has "ASI"
| where TimeGenerated >= ago(timeframe)
| extend DedupEntity = tostring(parse_json(tostring(parse_json(ExtendedProperties)["Custom Details"])).DedupEntity[0])
| project DedupEntity
) on DedupEntity
// End de-duplication logic.