Rename, rescan, disable, remove

The Agents page (/agents) lists every agent with its id, and lets you rename one, scan it again, stop it from reporting, bring it back, or remove it, one at a time or many at once. These actions need edit access to the Agents page; by default only administrators have it.

Agent statuses

Status	Meaning
Connected	The Wazuh agent reports
Lost contact	It reported before, but not recently
Waiting for first report	Registered; no report yet
Never connected	Registered; it has never connected
Disabled	An administrator disabled it
Held by licence	Over the licence's agent limit; it comes back when the licence has room. See Licence and agent limits

The Patching column shows Off, On, On, agent offline or Revoked.

Filter by status, platform, patching and activity, or search by name, address or id. Activity finds the agents that are not connected now, or that have not reported for 7 or 30 days.

Act on many agents

Tick the agents (the box in the header ticks every agent shown), then choose Rescan now, Disable, Enable or Remove in the bar above the list. Each action applies to the ticked agents it fits: Rescan to connected ones, Enable to disabled ones. Up to 100 at a time; the result lists any agent the action could not finish on, and why.

To retire machines that stopped reporting: filter Activity → No report for 30 days or more, tick the box in the header, and choose Disable or Remove.

Rename

Rename in the agent's menu sets the name the console shows: on this page, the endpoint list, vulnerabilities and patching. The agent keeps the name it registered with (shown as Registered as in its details) as its identity, so nothing changes on the machine and its history stays with it. Clear the name to go back to the registered one.

To register a machine under a different name from the start, run the install command with --name (-Name on Windows), or fill in Agent name in Add agents. Without it the machine uses its host name; when another machine has that name already (cloud images often share one, such as ubuntu), 4 characters of the machine's id are added, for example ubuntu-3f9a.

Rescan now

Rescan now restarts the monitoring agent on a connected machine. It reads the installed software again at start, and new or fixed vulnerabilities show within about 5 minutes. Monitoring pauses for a few seconds; nothing is installed or changed. With patching, the machine's Theseus agent does the restart and Patch jobs tracks it; without, the manager does. The same action is on the Patching page.

Disable

Use it when a machine should stop producing alerts and receiving actions for a while, without losing its registration.

1. Open the agent's menu, choose Disable agent, optionally give a reason.
2. On the manager, the agent is moved into the theseus-disabled group, which turns off file integrity monitoring, rootcheck, SCA, inventory and active response. Its previous groups are recorded.
3. When the machine has the Theseus agent, the Wazuh agent on it is first stopped and kept off at boot. Without the Theseus agent, the Wazuh agent keeps running and its log collection continues.

A disabled machine receives no patch jobs. Patch jobs queued before the disable fail rather than run.

Its data is kept but left out of the console: its vulnerabilities, patch candidates and its row on the endpoint list disappear until you enable it again. The vulnerability and patching pages say how many disabled agents they leave out.

Disabled agents still count towards the licence's agent limit. To free a place, remove the agent.

Enable

Enable agent restores the recorded groups (or default) and, with the Theseus agent, starts the Wazuh agent again. A machine that is offline gets the start when it next connects (within 7 days).

Remove

1. Choose Remove agent and type the agent's name to confirm.
2. Keep Also delete its data on to delete what it sent: alerts and logs, vulnerability findings, software inventory and its patch settings. Large amounts are deleted in the background. Patch job history and the audit log are kept. Turn it off to keep its past alerts searchable.
3. Keep Uninstall from the host first selected to have the machine remove both agents itself (needs the Theseus agent, online).
4. The agent is deleted from the manager and its enrolment revoked. This cannot be undone; the machine needs a new enrolment to come back.

A removed agent's vulnerabilities are never counted as fixed: the verification engine recognises an agent the manager no longer knows and drops its findings, even when it was removed outside the console.

If the uninstall cannot run (no Theseus agent, or offline), the console shows the command to run on the machine.

Uninstall on the machine

Linux and macOS, as root:

curl -fsSL --proto '=https' -o /tmp/theseus-install.sh 'https://soc.example.com/enroll/install.sh' \
  && sudo bash /tmp/theseus-install.sh --uninstall

(macOS: install-macos.sh.) Windows, elevated:

powershell -NoProfile -ExecutionPolicy Bypass -Command "& ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://soc.example.com/enroll/install.ps1'))) -Uninstall"

With the internal CA, use the uninstall command the console shows; it carries the certificate pin.

Uninstalling on the machine does not remove the agent from the console. Remove it there as well.

Revoke from Get started

Get started → Enrolled machines → Remove revokes the machine's enrolment: its Theseus agent's next request is refused. Optionally its Wazuh agent is removed too.

Audit

Every rename, rescan, disable, enable and remove is recorded with the person who did it.