Yes, this is possible, depending on your version of vSphere because earlier versions don't surface up what exactly changed.
For example, in the below example running in vSphere 6.5 U1, I disconnected a vNIC and found the message captured by vCenter forwarded to vRLI:
You can see what changed, who changed it, and when that occurred. Based on this, you can craft a query into an alert and do whatever you like with it. The highlighted word in the log output is the name of the VM.