def rule(event):
    if all(
        [
            event.deep_get("Status", default="") == "failure",
            event.deep_get("Location", default="") == "%UnLegitCountries%",
            event.deep_get("IPaddress", default="") == "%UnApprovedIp%",
            event.deep_get("DeviceInfo", default="") == "%UnApprovedDevice%",
        ]
    ):
        return True
    return False
