def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 4719,
            any(
                [
                    "%%8448" in event.deep_get("AuditPolicyChanges", default=""),
                    "%%8450" in event.deep_get("AuditPolicyChanges", default=""),
                ]
            ),
            not event.deep_get("SubcategoryGuid", default="")
            in [
                "{0CCE9210-69AE-11D9-BED3-505054503030}",
                "{0CCE9211-69AE-11D9-BED3-505054503030}",
                "{0CCE9212-69AE-11D9-BED3-505054503030}",
                "{0CCE9215-69AE-11D9-BED3-505054503030}",
                "{0CCE9217-69AE-11D9-BED3-505054503030}",
                "{0CCE921B-69AE-11D9-BED3-505054503030}",
                "{0CCE922B-69AE-11D9-BED3-505054503030}",
                "{0CCE922F-69AE-11D9-BED3-505054503030}",
                "{0CCE9230-69AE-11D9-BED3-505054503030}",
                "{0CCE9235-69AE-11D9-BED3-505054503030}",
                "{0CCE9236-69AE-11D9-BED3-505054503030}",
                "{0CCE9237-69AE-11D9-BED3-505054503030}",
                "{0CCE923F-69AE-11D9-BED3-505054503030}",
                "{0CCE9240-69AE-11D9-BED3-505054503030}",
                "{0CCE9242-69AE-11D9-BED3-505054503030}",
            ],
        ]
    ):
        return True
    return False
