BIOC Rule Through XQL vs Builder

[VarunPitale]

Here is my BIOC Rule using XQL. 

dataset = xdr_data
| filter event_type = ENUM.FILE
| filter agent_hostname = "XXXXX"
| filter action_file_path = "D:\XX\YY\*"
| filter event_sub_type = ENUM.FILE_RENAME OR event_sub_type = ENUM.FILE_REMOVE OR event_sub_type = ENUM.FILE_WRITE

I now get 12 alerts in the BIOC Rule

If I use Query Builder for BIOC, 

File [ action type = rename, delete, write AND file path = D:\XX\YY\* ] AND Host [ host name = XXXXX ]

I now get only 3 alerts in the BIOC Rule, all of which are present in the previous list of alerts.

I am trying to understand what is the difference in these 2 rules. As far as my eyes can see, they are the exact same rule.