AWS User Accessing Excessive Secrets

let timeframe = 2*1h;
let RuleId = "0235";
let DedupFields = dynamic(["TimeGenerated"]);
let time_period = 10m;
let access_threshold = 10;
// The rule will trigger when more than access_threshold secrets are requested in time_period.
AWSCloudTrail
| where ingestion_time() >= ago(timeframe)
| where EventName in ("GetPasswordData","GetSecretValue","Decrypt")
| extend SecretId=case(
    EventName == "GetPasswordData", parse_json(RequestParameters).instanceId,
    EventName == "GetSecretValue", parse_json(RequestParameters).secretId,
    EventName == "Decrypt", coalesce(parse_json(parse_json(RequestParameters).encryptionContext).SecretARN, parse_json(parse_json(RequestParameters).encryptionContext).PARAMETER_ARN)
    , ""
)
// For Decrypt only look at decryption of SSM secrets.
| where EventName != "Decrypt" or SecretId startswith "arn:aws:ssm"
| summarize arg_min(TimeGenerated, *), SecretCount=count(), Secrets=make_set(SecretId) by UserIdentityArn, TimeBin=bin(TimeGenerated, time_period)
| where SecretCount > access_threshold
// Begin environment-specific filter.
// End environment-specific filter.
| extend UserAccount=tostring(split(UserIdentityArn, "/")[-1])
// Begin de-duplication logic.
| extend DedupFieldValues=pack_all()
| mv-apply e=DedupFields to typeof(string) on (
    extend DedupValue=DedupFieldValues[tostring(e)]
| order by e // Sorting is required to ensure make_list is deterministic.
| summarize DedupValues=make_list(DedupValue)
)
| extend DedupEntity=strcat_array(DedupValues, "
| ")
| project-away DedupFieldValues, DedupValues
| join kind=leftanti (
    SecurityAlert
| where AlertName has RuleId and ProviderName has "ASI"
| where TimeGenerated >= ago(timeframe)
| extend DedupEntity = tostring(parse_json(tostring(parse_json(ExtendedProperties)["Custom Details"])).DedupEntity[0])
| project DedupEntity
) on DedupEntity
// End de-duplication logic.