def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 16403,
            not any(
                [
                    ".azureedge.net/" in event.deep_get("RemoteName", default=""),
                    ".com/" in event.deep_get("RemoteName", default=""),
                    ".sfx.ms/" in event.deep_get("RemoteName", default=""),
                    "download.mozilla.org/" in event.deep_get("RemoteName", default=""),
                    "cdn.onenote.net/" in event.deep_get("RemoteName", default=""),
                    "cdn.office.net/" in event.deep_get("RemoteName", default=""),
                    "tscdn.m365.static.microsoft/" in event.deep_get("RemoteName", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
