Yep, you have the gist of things here already.
The trigger I'd recommend would be vRLI or your syslog agent inside of XSOAR. NSX-T Manager's audit logs:
Odd, it won't let me paste, but you can filter on either
"display_name":"<tag>"
or the Object's UUID. I have attached an example NSGroup change.
