def rule(event):
    if all(
        [
            event.deep_get("cs-method", default="") == "GET",
            "/geoserver/ows" in event.deep_get("cs-uri-query", default=""),
            "CQL_FILTER=" in event.deep_get("cs-uri-query", default=""),
            any(
                [
                    "PropertyIsLike" in event.deep_get("cs-uri-query", default=""),
                    "strEndsWith" in event.deep_get("cs-uri-query", default=""),
                    "strStartsWith" in event.deep_get("cs-uri-query", default=""),
                    "FeatureId" in event.deep_get("cs-uri-query", default=""),
                    "jsonArrayContains" in event.deep_get("cs-uri-query", default=""),
                    "DWithin" in event.deep_get("cs-uri-query", default=""),
                ]
            ),
            any(
                [
                    "+--" in event.deep_get("cs-uri-query", default=""),
                    "+AS+" in event.deep_get("cs-uri-query", default=""),
                    "+OR+" in event.deep_get("cs-uri-query", default=""),
                    "FROM" in event.deep_get("cs-uri-query", default=""),
                    "ORDER+BY" in event.deep_get("cs-uri-query", default=""),
                    "SELECT" in event.deep_get("cs-uri-query", default=""),
                    "sleep%28" in event.deep_get("cs-uri-query", default=""),
                    "substring%28" in event.deep_get("cs-uri-query", default=""),
                    "UNION" in event.deep_get("cs-uri-query", default=""),
                    "WHERE" in event.deep_get("cs-uri-query", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
