Function to provide an XPath filter suitable for use in Azure Monitor Data Collection Rules.

New-DcrXPathFilter.ps1

function New-DcrXPathFilter {
    <#
    .SYNOPSIS
        Generates an XPath filter based on specified Event IDs and a log name.  

    .DESCRIPTION
        The New-DcrXPathFilter function takes an array of Event IDs, a log name,
        and an optional operator to create an XPath filter. This filter can be
        used to query specific events from the Windows Event Log.   

    .PARAMETER EventIds
        An array of integers representing the Event IDs to filter. This parameter
        is mandatory and must contain at least one valid Event ID.    

    .PARAMETER LogName
        The name of the Windows Event Log to filter. This parameter is mandatory.   

    .PARAMETER Operator
        Specifies the logical operator to use between the Event IDs in the filter.
        Accepted values are 'or' and 'and'. The default value is 'or'.   

    .EXAMPLE
        $EventIds = 4624, 4625
        $LogName = 'Security'
        $filter = New-DcrXPathFilter -EventIds $EventIds -LogName $LogName -Operator 'or'
        $filter will contain the XPath filter to search for events 4624 or 4625 in the Security log.    

    .INPUTS
        int[], string, string   

    .OUTPUTS
        string  

    .NOTES
        If more than 20 Event IDs are specified, the function will call itself
        recursively to build the filter.
    #>
    param(
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [int[]] $EventIds,
        
        [Parameter(Mandatory = $true)]
        [ValidateNotNullOrEmpty()]
        [string] $LogName,

        [ValidateSet('or', 'and')]
        [string] $Operator = 'or'
    )
    
    # Check log name
    $LogName = (Get-WinEvent -ListLog * -ea SilentlyContinue | Where-Object LogName -eq $LogName ).LogName
    if (-not $LogName) {
        throw 'Log name not found. Try running the following: (Get-WinEvent -ListLog * | Where-Object LogName -like "*$LogName*").LogName'
    }


    if ($EventIds.Count -eq 1) {
        return "$LogName!*[System[EventID=${EventIds[0]}]]"
    } elseif ($EventIds.Count -gt 20) {
        $output = @()
        $output += New-DcrXPathFilter -EventIds $EventIds[0..19] -LogName $LogName -Operator $Operator
        $output += New-DcrXPathFilter -EventIds $EventIds[20..($EventIds.Count - 1)] -LogName $LogName -Operator $Operator
        return $output
    } else {
        $sb = [System.Text.StringBuilder]::new()
        $null = $sb.Append(('{0}!*[System[(' -f $LogName))
        $limit = $EventIds.Count - 1
        for ($i = 0; $i -lt $limit; $i++) {
            $null = $sb.Append("EventID={$EventIds[$i]} $Operator ")
        }
        # Append the last EventID without the 'or'
        $null = $sb.Append("EventID={$EventIds[-1]}")
        $null = $sb.Append(')]]')
        return $sb.ToString()
    }
}