[ossec-list] How can OSSEC audit user shell(like bash,tcsh) command

[showrun.lee]

If I want to monitor the command a user put use shell(bash,tcsh),and
if he does dangerous command, use the rules I can get alerm.

I want to know , does OSSEC can do this?