Create a new alert, under Trigger Condition select Auditing Event, Audit Event Message, Contains, AlertID
That should get you started. You may need to look in your Message Center under Show Audit Events to get more specific text than AlertID for your system.
If you want to look deeper into your audit log events with SWQL Studio you can use the query below. You can uncomment the Where clause and add whatever text you would like to search for by replacing change custom with your own wording. Perhaps you can find an event that closer matches what you are looking for.
SELECT TOP 1000 AuditEventID, TimeLoggedUtc, AccountID, ActionTypeID, AuditEventMessage, NetworkNode, NetObjectID, NetObjectType, DetailsUrl, DisplayName, ObservationTimestamp, ObservationRowVersion, ObservationSeverity, ObservationSeverityName, Description, InstanceType, Uri, InstanceSiteId
FROM Orion.AuditingEvents
--Where AuditEventMessage LIKE '%changed custom%' Order BY TimeLoggedUTC desc
@bobmarley Thanks for your response this is giveing the general audit logs but am looking much deeper similar like NCM config change notification which need to show what changs done. For example if am changing the trigger action that i need to get in that alert.