sudokill

If I'm planning to write tetragon policies for new CVE's .
Then how should i actually instrument the exploit so I can understand the different syscalls involved , binary it executes etc .
Any resources are pretty much appreciated.