Howto alert on non IT folks running a CLI

TL;DR how to enable logging and then query against a white list of IT folks to identify possible users getting phished.