def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("EventID", default="") == 4719,
                    event.deep_get("SubcategoryGuid", default="")
                    in [
                        "{0CCE9210-69AE-11D9-BED3-505054503030}",
                        "{0CCE9211-69AE-11D9-BED3-505054503030}",
                        "{0CCE9212-69AE-11D9-BED3-505054503030}",
                        "{0CCE9215-69AE-11D9-BED3-505054503030}",
                        "{0CCE921B-69AE-11D9-BED3-505054503030}",
                        "{0CCE922B-69AE-11D9-BED3-505054503030}",
                        "{0CCE922F-69AE-11D9-BED3-505054503030}",
                        "{0CCE9230-69AE-11D9-BED3-505054503030}",
                        "{0CCE9235-69AE-11D9-BED3-505054503030}",
                        "{0CCE9236-69AE-11D9-BED3-505054503030}",
                        "{0CCE9237-69AE-11D9-BED3-505054503030}",
                        "{0CCE923F-69AE-11D9-BED3-505054503030}",
                        "{0CCE9240-69AE-11D9-BED3-505054503030}",
                        "{0CCE9242-69AE-11D9-BED3-505054503030}",
                    ],
                    any(
                        [
                            "%%8448" in event.deep_get("AuditPolicyChanges", default=""),
                            "%%8450" in event.deep_get("AuditPolicyChanges", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("EventID", default="") == 4719,
                    event.deep_get("SubcategoryGuid", default="")
                    == "{0CCE9217-69AE-11D9-BED3-505054503030}",
                    "%%8448" in event.deep_get("AuditPolicyChanges", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
