the moment of authorization users

Good afternoon, guys.
Need a script that sends a message at the time of user authorization via winbox.
Please help implement the idea, I can not think of how to catch the moment of authorization.

is that correct?
firewall tcp dst 8291 forward/input
can I run the script on the log?