Using an "OR" for monitoring multiple possible event entries

Hi, I am doing a rule to monitor if people are added or removed from the domain admins, built in groups or enterprise admins on Windows 2008 DC's.

This looks like it would be from events 4728, 4729, 4732, 4733, 4755 and 4756.

I could write 6 rules but would prefer just one. I have been looking at "expressions" -

http://support.microsoft.com/kb/2702651/en-gb

but cant really get this going. I have tried 4278 | 4729 for instance as an OR but it dosent work..

Any ideas?

thanks