So, at my company they started using fleetdm, which is fair (they even disabled some privacy concerning tables), but I'm a privacy freak so I've enabled orbit log file and wrote this script to get a desktop notification whenever a query is performed by remote.

In future I would like to implement "allowed queries" so that I don't get a notification for known queries.