Threat intel, e-mail, Jira, NIDS

Set these up in the console under Admin → Integrations: fill in the fields, Test connection, Save. The change is applied within a minute. The settings named below are what each field sets; full list: Configuration settings.

Threat intelligence

Admin → Integrations → Threat intelligence. Any one key is enough to start.

Setting	Service
ABUSEIPDB_API_KEY	AbuseIPDB reputation
VIRUSTOTAL_API_KEY	VirusTotal
OTX_API_KEY	AlienVault OTX
MISP_URL, MISP_API_KEY	Your MISP instance
NVD_API_KEY	NVD, used by vuln-verify; raises NVD's rate limits

They enrich alerts and the Threat intel page.

E-mail (SMTP)

Admin → Integrations → Email and webhook.

Setting	Default
SMTP_HOST, SMTP_PORT	port 587
SMTP_USERNAME, SMTP_PASSWORD
SMTP_FROM
SMTP_USE_TLS (STARTTLS), SMTP_USE_SSL (implicit TLS, usually port 465; wins over STARTTLS)	true, false

Used for stack health alerts, scheduled reports, scanner reports, policy engine notifications and password resets.

Stack health alerts

Also under Admin → Integrations → Email and webhook.

Setting	Effect
ALERT_EMAIL	Receives health alerts. Defaults to the administrator's e-mail
ALERT_WEBHOOK	Receives the same alerts as JSON

The ops service checks every part of the stack every minute. After three failed checks in a row it sends [Theseus <tenant>] DOWN: <names>, a reminder every hour while it stays down, and a RECOVERED message when everything is back.

Jira

Admin → Integrations → Jira (needs the AI analyst). It turns on the jira module and sets JIRA_BASE_URL, JIRA_CLIENT_ID, JIRA_CLIENT_SECRET, JIRA_CLOUD_ID, JIRA_PROJECT_KEY and JIRA_WEBHOOK_SECRET. See Pallas.

Suricata NIDS

A Suricata sensor on your network runs the Theseus sensor agent (separate from the stack) and reports to it. In Admin → Integrations → Network sensor (Suricata), fill in the sensor URL and token (SURICATA_AGENT_URL, SURICATA_AGENT_TOKEN); the NIDS pages then appear in the console.

Scheduled reports

The reporting module e-mails reports to ALERT_EMAIL: daily at 09:00 (SIEM, NIDS, compliance, agents, high-priority, vendor and incident reports), weekly on Fridays at 18:00, and monthly on the 28th. The time zone is REPORT_TZ (default UTC). REPORT_LLM_ENABLED=true adds LLM-written summaries. Each report can be turned off in theseus.env with its own toggle, for example REPORT_SOPHOS_ENABLED=false; see Configuration for the list.

Copy alerts to another OpenSearch

REPLICA_URL, REPLICA_USERNAME, REPLICA_PASSWORD and REPLICA_PATTERNS (default wazuh-alerts-*): the ops service copies matching indices every 5 minutes.