If you create an alert rule using the following, it should give you what you are looking for.
**************
/*
This basic template is a placeholder for defining basic EPL content that can be
installed and executed in ESA. The sample below is the minimum that would be
required to get started.
Version: 4.0
*/
/*
Module debug section. If this is empty then debugging is off.
*/
/* EPL section. If there is no text here it means there were no statements. */
module Module_54768373e4b0e51f47f9a9a7;
@Name('Module_54768373e4b0e51f47f9a9a7_Alert')
@Description('')
@RSAAlert(oneInSeconds=0)
SELECT * FROM Event(
/* Statement: Windows Events */
(reference_id IN ( '4720' ) OR reference_id IN ( '4726' ) OR reference_id IN ( '4728' ))
AND
/* Statement: windows */
(device_type IN ( 'winevent_nic' ))
)
;
