Can we trigger an event/action upon the session manager logs stored on Cloud Watch ?

Like upon execution of certain commands,  the user should be logged out or the privileges should be de-escalated.