def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("Image", default="").endswith("/arp"),
                    "-a" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("/ping"),
                    any(
                        [
                            " 10." in event.deep_get("CommandLine", default=""),
                            " 192.168." in event.deep_get("CommandLine", default=""),
                            " 172.16." in event.deep_get("CommandLine", default=""),
                            " 172.17." in event.deep_get("CommandLine", default=""),
                            " 172.18." in event.deep_get("CommandLine", default=""),
                            " 172.19." in event.deep_get("CommandLine", default=""),
                            " 172.20." in event.deep_get("CommandLine", default=""),
                            " 172.21." in event.deep_get("CommandLine", default=""),
                            " 172.22." in event.deep_get("CommandLine", default=""),
                            " 172.23." in event.deep_get("CommandLine", default=""),
                            " 172.24." in event.deep_get("CommandLine", default=""),
                            " 172.25." in event.deep_get("CommandLine", default=""),
                            " 172.26." in event.deep_get("CommandLine", default=""),
                            " 172.27." in event.deep_get("CommandLine", default=""),
                            " 172.28." in event.deep_get("CommandLine", default=""),
                            " 172.29." in event.deep_get("CommandLine", default=""),
                            " 172.30." in event.deep_get("CommandLine", default=""),
                            " 172.31." in event.deep_get("CommandLine", default=""),
                            " 127." in event.deep_get("CommandLine", default=""),
                            " 169.254." in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
