Appearance
Verify the install
Run these checks after the install summary appears, and again whenever something looks wrong.
1. Service status on the server
bash
cd /opt/theseus && sudo ./theseus statusThe output has three parts:
The server's role (and release).
One line per container: service, state, health, ports. Every service should be
running; services with a health check should behealthy. One-shot services (volumes-init,keycloak-config) showexitedonce done; that is expected.The health probes, one line each,
uporDOWN, with a detail:textup indexer ... up manager-api ... up dashboard ... up keycloak ... up console-api ... up console-ui ... up enroll ... up web ... console: https://soc.example.com/
On the first start the Wazuh indexer can take several minutes; probes may show DOWN until it is ready. If a probe stays DOWN for more than 10 minutes, see Stack and services.
2. From your computer
bash
curl -sS -o /dev/null -w '%{http_code}\n' https://soc.example.com/enroll/health200 means the gateway and the enrolment service answer. With the internal CA, add --cacert theseus-ca.pem (or -k for this test only).
Then open https://soc.example.com/ and sign in.
3. In the console
- Open Admin → Platform health. Every tile should be Operational, except integrations you have not configured.
- Open Get started. The first item, Platform is healthy, should be done.
4. Enrol one endpoint
Enrol a test machine with the commands from Get started → Add your first agent (see Enrol endpoints). It appears under Enrolled machines within a minute, and on the Agents page as Connected.
Next steps
| Task | Where |
|---|---|
| Enrol endpoints, with or without patching | Enrol endpoints |
| Create accounts for your analysts | Users and roles |
| Connect AWS, Cloudflare, Microsoft, Sophos | Integrations |
| Set up Pallas | Pallas AI analyst |
| Set up stack health alerts by e-mail or webhook | ALERT_EMAIL, ALERT_WEBHOOK in Configuration settings |
| Plan backups | Backup |