def rule(event):
    if all(
        [
            event.deep_get("eventName", default="") == "ConsoleLogin",
            event.deep_get("responseElements", "ConsoleLogin", default="") == "Success",
            not any(
                [
                    event.deep_get("src_country", default="") == "%Legitimate_Countries%",
                    event.deep_get("src_ip", default="") == "%Legitimate_IP_Ranges%",
                ]
            ),
        ]
    ):
        return True
    return False
