You could do this from the Syslog server that forwards the messages to NCM, IE Kiwi. You could create a custom script for the forwarding with a delay.
Outside of that, NCM has some delay implemented already (I don't know what the value is) but I have never ran into a situation where it didn't actually detect a change.
Lastly, you should always run a daily backup regardless of realtime change detection, then check in the morning for devices that it detected a difference in during that job. This way you can work down into the finite details of what happened per device that didn't catch a change.
