def rule(event):
    if any(
        [
            "tunnel.us.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.eu.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.ap.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.au.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.sa.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.jp.ngrok.com" in event.deep_get("DestinationHostname", default=""),
            "tunnel.in.ngrok.com" in event.deep_get("DestinationHostname", default=""),
        ]
    ):
        return True
    return False
