The table that just lists out syscalls might be an easier first attempt, and doing some form of table that "subscribes" to syscalls and logs syscalls made by applications might be more difficult and require some kernel land code. I'm also not entirely convinced osquery would be the best tool for this? But others with stronger Linux background than I could probably argue better cases 🙂