def rule(event):
    if all(
        [
            "MSSQL" in event.deep_get("Provider_Name", default=""),
            event.deep_get("EventID", default="") == 18456,
            not any(
                [
                    "CLIENT: 10." in event.deep_get("Data", default=""),
                    "CLIENT: 172.16." in event.deep_get("Data", default=""),
                    "CLIENT: 172.17." in event.deep_get("Data", default=""),
                    "CLIENT: 172.18." in event.deep_get("Data", default=""),
                    "CLIENT: 172.19." in event.deep_get("Data", default=""),
                    "CLIENT: 172.20." in event.deep_get("Data", default=""),
                    "CLIENT: 172.21." in event.deep_get("Data", default=""),
                    "CLIENT: 172.22." in event.deep_get("Data", default=""),
                    "CLIENT: 172.23." in event.deep_get("Data", default=""),
                    "CLIENT: 172.24." in event.deep_get("Data", default=""),
                    "CLIENT: 172.25." in event.deep_get("Data", default=""),
                    "CLIENT: 172.26." in event.deep_get("Data", default=""),
                    "CLIENT: 172.27." in event.deep_get("Data", default=""),
                    "CLIENT: 172.28." in event.deep_get("Data", default=""),
                    "CLIENT: 172.29." in event.deep_get("Data", default=""),
                    "CLIENT: 172.30." in event.deep_get("Data", default=""),
                    "CLIENT: 172.31." in event.deep_get("Data", default=""),
                    "CLIENT: 192.168." in event.deep_get("Data", default=""),
                    "CLIENT: 127." in event.deep_get("Data", default=""),
                    "CLIENT: 169.254." in event.deep_get("Data", default=""),
                    "CLIENT: <local machine>" in event.deep_get("Data", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
