docs: How can I use Hooks (if at all) in Tracee Policies?

[AnaisUrlichs]

As part of our extra events, we specify hooks e.g. file_modified is a hook within file_modification
Can I just use the hook directly as the event within the file section of the policy or do I need to specify it differently?

spec:
    scope:
      - container
    rules:
      - event: file_modified

https://aquasecurity.github.io/tracee/v0.17/docs/events/builtin/extra/file_modification/#hooks

[josedonizetti]

The hooks mentioned there are where tracee will hook in order to generate the event, in this case, file_modification and they are not exposed to the user https://github.com/aquasecurity/tracee/blob/main/pkg/events/core.go#L10436-L10458

The user only uses events, and you can see the ones supported by running `tracee list.

[AnaisUrlichs]

Ahhh thank you for clarifying