As for the specifics of what that table might look like, that really depends on what you're wanting to get out of the table. It could be an event publisher/subscriber that monitors syscalls, maybe a table that takes in a path to a binary and enumerates all syscalls the binary will make?