Add AWS CloudWatch Logs high volume retrieval dataset

[themaryjo]

Summary

Adds an anonymized AWS CloudTrail dataset for repeated Amazon CloudWatch Logs read operations.

Dataset

• 650 GetLogEvents operations
• 650 unique CloudTrail event IDs
• 650 unique request IDs
• One AWS principal and account
• 37-second event window
• MITRE ATT&CK T1530
• Sourcetype: aws:cloudtrail

Validation

• Confirmed 650 valid JSON objects
• Confirmed one JSON object per line
• Confirmed anonymized account, identity, source IP, Region, and endpoint values
• Confirmed all events occurred within five minutes

Related detection

A corresponding security_content detection for repeated CloudWatch Logs read operations is being developed and will be linked when its draft PR is available.

[github-actions]

✅ Attack Data Validation Passed

All YAML files in this PR have been successfully validated against the schema.

Ready for review and merge! 🚀