docs: syscalls as Tracee events

[AnaisUrlichs]

Just to clarify, I can use syscalls as events in the Tracee Policy?

e.g. https://aquasecurity.github.io/tracee/v0.17/docs/events/builtin/syscalls/open/

spec:
    scope:
      - container
    rules:
      - event: open

[geyslan]

Yep, take a look at examples/policies/openat_args_pahtname.yaml

❯ cat examples/policies/openat_args_pahtname.yaml
apiVersion: aquasecurity.github.io/v1beta1
kind: TraceePolicy
metadata:
  name: openat-args-pathname
  annotations:
    description: traces openat under /tmp/*
spec:
  scope: 
    - global
  rules:
    - event: openat
      filters:
        - args.pathname=/tmp*

[AnaisUrlichs]

Cool, thank you @geyslan

[AnaisUrlichs]

Will leave this issue open until I documented it

[yanivagman]

Will leave this issue open until I documented it

Which documentation do you want to add other than https://aquasecurity.github.io/tracee/v0.17/docs/events/builtin/syscalls/open/?

[AnaisUrlichs]

@yanivagman I was planning on detailing in the Policies section where people can find information on the events they can add to the policy -- I might be learning this right now but a completely new users will not know -- will tag this issue in the PR