a good example of that is how osquery can hook into the Linux kernel's inotify feature, which provides evidence of ephemeral files.