def rule(event):
    if event.deep_get("FileName", default="").endswith("\\Panther\\unattend.xml"):
        return True
    return False
