Type /debug @debug before such a command and check the debug window for such things, that usually gives better info.
This knock event appears to be a channel CTCP event, so I'm guessing
ctcp *:knock:#:echo @extra CTCP: $nick knocked on the door: $1-
But the best option is to just try to catch them all:
on *:SNOTICE:*:echo @extra SERVER MESSAGE: $1-
on *:NOTICE:*:#:echo @extra NOTICE from $nick to $chan : $1-
One of those should catch that message...
