def rule(event):
    if all(
        [
            event.deep_get("ActivityDetails", default="") == "Sign-ins",
            event.deep_get("ClientApp", default="")
            in [
                "Other client",
                "IMAP",
                "POP3",
                "MAPI",
                "SMTP",
                "Exchange ActiveSync",
                "Exchange Web Services",
            ],
            event.deep_get("Username", default="") == "UPN",
        ]
    ):
        return True
    return False
