When syslog-ng drops a core file, there is a systemd message about it, for example:
"2019-01-16T11:04:48+01:00 systemd: syslog-ng.service: Failed with result 'core-dump'."
There is a feature called Content Based Alert (CBA), which can be used to notify about core files.
The search expression for the alert is:
program:systemd syslog-ng.service Failed with result core-dump
Please note that there is also an ER that has been raised so that this functionality is configurable through the SSB GUI, Basic Settings --> Alerting & Monitoring.
At current there is no ETA on this.
If you would like more information on this ER please contact your One Identity account representative.