Appearance
Network and firewall
Every connection Theseus makes or accepts, by topology. "Inbound" is towards the Theseus server.
One server
Inbound
| Port | Protocol | From | Purpose |
|---|---|---|---|
| 443 | TCP (HTTPS) | Analysts, and every endpoint | Console, sign-in, Pallas, SIEM dashboard, agent installers and enrolment (/enroll), the Theseus agent channel (/agent) |
| 1514 | TCP | Every endpoint | Wazuh agent events to the manager |
| 80 | TCP (HTTP) | Analysts; the internet when using Let's Encrypt | Redirect to HTTPS, and Let's Encrypt validation |
Nothing else needs to be reachable. Port 1515 (Wazuh registration) is not published.
With syslog from network devices set up, also UDP 514 from the devices you list. The port is published only while that integration is set up.
Outbound from the server
| Destination | Port | When | Purpose |
|---|---|---|---|
| Theseus control plane (the host in your install command) | the port in the command, usually 443 | Always | theseus-node: install, configuration, licence, health reports; image registry (/v2/) |
download.docker.com | 443 | During install, if Docker is missing | Docker packages |
Let's Encrypt (acme-v02.api.letsencrypt.org) | 443 | TLS_MODE=acme | Certificate issue and renewal |
| Your LLM endpoint | its port | ai module | Pallas, AI triage, summaries |
services.nvd.nist.gov, api.msrc.microsoft.com, security-metadata.canonical.com, www.cisa.gov | 443 | Always | vuln-verify feeds (NVD, Microsoft, Ubuntu, CISA KEV) |
cti.wazuh.com | 443 | Always | Wazuh manager vulnerability detection content |
| Vendor APIs | 443 | When a connector or perimeter integration is configured | AWS, Cloudflare (api.cloudflare.com), Microsoft (login.microsoftonline.com, api.security.microsoft.com, graph.microsoft.com), Sophos Central |
| Your SMTP server | 25, 465 or 587 | When SMTP is set | Alerts, reports, password resets |
| Scan targets | as scanned | scanner module | External scans of the targets you choose |
Keep the control plane reachable
The licence is renewed over this connection. A stack that cannot reach the control plane for 7 days falls back to one agent until it reconnects. See Licence and agent limits.
Two servers
Each server needs the outbound rules above that apply to its services (both run theseus-node; the core runs vuln-verify and the Wazuh manager, the app runs Pallas and the console).
Application server (app)
| Port | Protocol | From | Purpose |
|---|---|---|---|
| 443 | TCP | Analysts, every endpoint | As for one server |
| 80 | TCP | Analysts; the internet with Let's Encrypt | As for one server |
Core server (core)
| Port | Protocol | From | Purpose |
|---|---|---|---|
| 1514 | TCP | Every endpoint | Wazuh agent events |
| 514 | UDP | The network devices you list | Syslog, only while syslog is set up |
| 9200 | TCP | Application server only | Wazuh indexer |
| 55000 | TCP | Application server only | Wazuh manager API |
| 5601 | TCP | Application server only | Wazuh dashboard (proxied by the app at /siem/) |
| 9001 | TCP | Application server only | Scanner API (the console's scan pages) |
The four core ports are published only on the core's private address. Never expose them to the internet; restrict them to the application server's address.
Endpoints connect to two addresses in this topology: the application server for HTTPS (443) and the core for Wazuh events (1514). The address agents use for 1514 is AGENT_HOST; make sure it is one endpoints can reach. See Install on two servers.
Endpoints
Each enrolled machine needs outbound access only; nothing is opened on endpoints.
| Destination | Port | Purpose |
|---|---|---|
Your console address (THESEUS_HOST) | 443 | Installer download, enrolment, and the Theseus agent channel when patching is on |
The agent address (AGENT_HOST, by default the console address) | 1514 | Wazuh agent events |
packages.wazuh.com | 443 | Wazuh agent package, during install only |
The Theseus agent's channel is a long-poll that stays open up to about 30 seconds. Proxies and firewalls with very short idle timeouts break it; allow at least 60 seconds.
Behind a load balancer or Cloudflare
With a cloud gateway in front, the gateway carries HTTPS and the server receives plain HTTP from it on UPSTREAM_HTTP_PORT (8088), accepted only from the gateway's addresses. Port 1514 still needs a TCP path (a network load balancer or a direct DNS-only name). See Cloud gateways.