def rule(event):
    if all(
        [
            event.deep_get("TargetFilename", default="").endswith("/etc/nsswitch.conf"),
            not event.deep_get("TargetFilename", default="")
            in ["/etc/nsswitch.conf", "/usr/share/factory/etc/nsswitch.conf"],
        ]
    ):
        return True
    return False
