How do i monitor if some is trying to break the Sophos tamper?

Thank you for reaching out to the community forum.

For tamper protection, Receiving alerts for password failure attempts isn’t possible, as it only shows in reports when TP is successfully turned On/Off. 

that is surprising though as we should have some mechanism to detect tampering of the Endpoint protection software as attackers would attempt to do so normally.