def rule(event):
    if event.deep_get("operation", default="").startswith("efs"):
        return True
    return False
