Netwrix Auditor System Health Log contains the following EventID: 1207
“Automatic Netwrix Auditor for SharePoint Core Service deployment failed“.
The Netwrix Auditor for SharePoint Core Service version is different from the product version.
When you upgrade Netwrix Auditor to a newer version, you must manually uninstall the core service from the computer that hosts SharePoint Central Administration. After that, the product will automatically install the latest version of the core service (if automatic deployment mode is selected on Monitoring Plan creation).
If you want to install the core service manually, refer to the following Kowledge Base article for instructions: How to manually install Netwrix Auditor Agent for SharePoint?
The agent installation package can be found at %Netwrix Auditor installation folder%\SharePoint Auditing\SharePointPackage\SpaPackage_<version>.msi