Theseus documentation

Theseus is a security operations platform built on Wazuh: SIEM and XDR, a console for your analysts (Ageleia), an AI analyst (Pallas), verified patching and perimeter response, installed as one stack on your own server or run by us.

These pages are for the IT and security administrators who deploy Theseus, and for the analysts who work in its console.

Start here

What is TheseusComponents, how they fit, and what runs where.Deployment optionsOne server, two servers, or hosted by us.RequirementsOperating systems, CPU, memory, disk and kernel settings.Network and firewallEvery port, in which direction, for each topology.Install on one serverThe install command, step by step, to first sign-in.Install on two serversCore and application servers, in order.Enrol endpointsLinux, macOS and Windows commands; patching opt-in.TroubleshootingSymptom, cause, fix, with the commands to diagnose.

Day to day

Tour of the consoleNavigation, roles and where things are.PatchingFrom a verified vulnerability to a remediated host.ComplianceControls, the evidence pack for auditors, and how long logs are kept.PallasAsk the AI analyst; triage alerts with it.IntegrationsAWS, Cloudflare, Microsoft, Sophos and more.Status and logsIs everything healthy, and where to look when not.theseus CLIEvery command of ./theseus.Configuration settingsEvery setting, its type, default and meaning.Security and data flowsWhat leaves your network, and how credentials are kept.