An alternative to the auditd daemon with goals of safety, speed, JSON output, and pluggable pipelines connecting to the Linux kernel via netlink.
Checked October 2026.
About go-audit is an alternative to the auditd daemon that ships with many distros. After having created an auditd audisp plugin to convert audit logs to json, I became interested in creating a replacement for the existing daemon.
Goals:
Connects to the Linux kernel via netlink.
Usage:
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about go-audit: features, pricing and alternatives.
go-audit is a product in the Security Information and Event Management category. It covers Linux.
go-audit is free. Download and setup instructions are at https://github.com/slackhq/go-audit/.
Alternatives to go-audit listed on CybersecTools:
Compare all go-audit alternatives at https://cybersectools.com/alternatives/go-audit
go-audit is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Cloud-native SIEM for log management, threat detection, investigation, and response
SIEM platform for small teams with threat detection & event observability.
AI-driven SIEM with streaming analytics, UEBA, and autonomous SOC workflows.
Hosted SIEM-as-a-Service with 24/7 SOC monitoring and MXDR integration
Security data platform for log analysis, metrics, and threat hunting
AI-powered SIEM, API security, and log management platform
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
