def rule(event):
    if all(
        [
            event.deep_get("EventLog", default="") == "RPCFW",
            event.deep_get("EventID", default="") == 3,
            event.deep_get("InterfaceUuid", default="") == "1ff70682-0a51-30e8-076d-740be8cee98b",
            not event.deep_get("OpNum", default="") in [0, 1],
        ]
    ):
        return True
    return False
