def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 29,
            "/system.webServer/modules/add" in event.deep_get("Configuration", default=""),
            not any(
                [
                    event.deep_get("NewValue", default="")
                    in [
                        "AnonymousAuthenticationModule",
                        "CustomErrorModule",
                        "DefaultDocumentModule",
                        "DirectoryListingModule",
                        "FileCacheModule",
                        "HttpCacheModule",
                        "HttpLoggingModule",
                        "ProtocolSupportModule",
                        "RequestFilteringModule",
                        "StaticCompressionModule",
                        "StaticFileModule",
                        "TokenCacheModule",
                        "UriCacheModule",
                    ],
                    event.deep_get("NewValue", default="") == "",
                ]
            ),
        ]
    ):
        return True
    return False
