def rule(event):
    if all(
        [
            event.deep_get("eventType", default="")
            in ["user.lifecycle.create", "user.lifecycle.activate"],
            "svc_network_backup" in event.deep_get("target", "displayName", default=""),
        ]
    ):
        return True
    return False
