def rule(event):
    if all(
        [
            "Add memmber to role completed (PIM aciviation)"
            in event.deep_get("properties", "message", default=""),
            event.deep_get("Location", default="") == "%LegitCountries%",
            event.deep_get("IPaddress", default="") == "%UnApprovedIp%",
            event.deep_get("DeviceInfo", default="") == "%UnApprovedDevice%",
            event.deep_get("DeviceDetail", "isCompliant", default="") == "false",
            event.deep_get("Status", default="") in ["Sucess", "failure"],
        ]
    ):
        return True
    return False
