import re


def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            event.deep_get("c-useragent", default="").startswith("user-agent"),
                            event.deep_get("c-useragent", default="").startswith("Mozilla/3.0 "),
                            event.deep_get("c-useragent", default="").startswith("Mozilla/2.0 "),
                            event.deep_get("c-useragent", default="").startswith("Mozilla/1.0 "),
                            event.deep_get("c-useragent", default="").startswith("Mozilla "),
                            event.deep_get("c-useragent", default="").startswith(" Mozilla/"),
                            event.deep_get("c-useragent", default="").startswith("Mozila/"),
                            event.deep_get("c-useragent", default="").startswith(
                                "Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol"
                            ),
                        ]
                    ),
                    any(
                        [
                            " (compatible;MSIE " in event.deep_get("c-useragent", default=""),
                            ".0;Windows NT " in event.deep_get("c-useragent", default=""),
                            "loader" in event.deep_get("c-useragent", default=""),
                        ]
                    ),
                    event.deep_get("c-useragent", default="")
                    in [
                        "_",
                        "CertUtil URL Agent",
                        "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)",
                        "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0",
                        "HTTPS",
                        "Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a",
                        "x",
                        "xxx",
                    ],
                ]
            ),
            not any(
                [
                    re.match(
                        r"^Mozilla/3.0 .* Acrobat .*$", event.deep_get("c-useragent", default="")
                    ),
                    any(
                        [
                            event.deep_get("cs-host", default="").endswith(".acrobat.com"),
                            event.deep_get("cs-host", default="").endswith(".adobe.com"),
                            event.deep_get("cs-host", default="").endswith(".adobe.io"),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
