Within you props.conf try the following.
[WinEventLog:Security]
TRANSFORMS-set= setnull,setparsing
This should send events with EventCodes 4634 and 4624 to the indexer while sending all others to null queue. With only one transform stanza defined setnull define in you props you are send all events to the nullQueue.
... View more