mv_query

<QueryXML>
  <QueryList>
    <Query Id="0">
      <Select Path="Security">*[System[(EventID=4625 or EventID=4624 or EventID=4720 or EventID=4726 or EventID=4732 or EventID=4740 or EventID=1102)]]</Select>
      <Select Path="System">*[System[(Level=1 or Level=2)]]</Select>
    </Query>
  </QueryList>
</QueryXML>