def rule(event):
    if all(
        [
            "azurefd.net" in event.deep_get("DestinationHostname", default=""),
            not any(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("brave.exe"),
                            event.deep_get("Image", default="").endswith("chrome.exe"),
                            event.deep_get("Image", default="").endswith("chromium.exe"),
                            event.deep_get("Image", default="").endswith("firefox.exe"),
                            event.deep_get("Image", default="").endswith("msedge.exe"),
                            event.deep_get("Image", default="").endswith("msedgewebview2.exe"),
                            event.deep_get("Image", default="").endswith("opera.exe"),
                            event.deep_get("Image", default="").endswith("vivaldi.exe"),
                        ]
                    ),
                    event.deep_get("Image", default="").endswith("searchapp.exe"),
                    any(
                        [
                            "afdxtest.z01.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                            "fp-afd.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                            "fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                            "roxy.azurefd.net" in event.deep_get("DestinationHostname", default=""),
                            "powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                            "storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                            "graph.azurefd.net"
                            in event.deep_get("DestinationHostname", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
