You can use XML query to filter events.
XML queries are executed on target computers, so this way of
event filtering may work much faster than others.
To display XML query dialog box, select
from the main menu of the
Type your query (you can use Structured XML Query or XPath 1.0
These two examples show security events with Event ID=5152 or
*[System[(EventID=5152 or EventID=5157)]]
Load button loads XML query
from a file.
Save button saves the XML
query to a file.