def rule(event):
    if all(
        [
            any(
                [
                    all(
                        [
                            event.deep_get("c-useragent", default="")
                            == "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
                            event.deep_get("cs-method", default="") == "GET",
                            event.deep_get("c-uri", default="")
                            == "/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books",
                            event.deep_get("cs-host", default="") == "www.amazon.com",
                            event.deep_get("cs-cookie", default="").endswith(
                                "=csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996"
                            ),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("c-useragent", default="")
                            == "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
                            event.deep_get("cs-method", default="") == "POST",
                            event.deep_get("c-uri", default="") == "/N4215/adj/amzn.us.sr.aps",
                            event.deep_get("cs-host", default="") == "www.amazon.com",
                        ]
                    ),
                    event.deep_get("c-useragent", default="")
                    in [
                        "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)",
                        "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )",
                        "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08",
                    ],
                    event.deep_get("c-useragent", default="").endswith("; MANM; MANM)"),
                    all(
                        [
                            "/oscp/" in event.deep_get("c-uri", default=""),
                            event.deep_get("cs-host", default="") == "ocsp.verisign.com",
                        ]
                    ),
                    all(
                        [
                            event.deep_get("cs-method", default="") == "GET",
                            event.deep_get("c-uri", default="").endswith("\\?manifest=wac"),
                            event.deep_get("cs-host", default="") == "onedrive.live.com",
                        ]
                    ),
                ]
            ),
            not all(
                [
                    event.deep_get("c-uri", default="").startswith("http"),
                    "://onedrive.live.com/" in event.deep_get("c-uri", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
