Script to detect changes to Log or User accounts?

Hello Everyone,

I have recently been tasked with creating a script to monitor changes in user accounts and log recording size to indicate whether a router has been compromised. I have never scripted anything for RouterOS so I am looking for some tips or suggestions on how I should go about that. Any help would be greatly appreciated.

Thanks!