Backup

What ./theseus backup saves

cd /opt/theseus && sudo ./theseus backup            # into ./backups/
sudo ./theseus backup /srv/backup/theseus           # or a directory of your choice

It writes one file, theseus-<UTC timestamp>.tar.gz (mode 0600), with a manifest.json that records each part's checksum:

Part	Contents
app-db.dump	The console database: configuration, roles and page grants, audit log, mutes, policy rules
keycloak-db.dump	Users, passwords and sign-in configuration (including single sign-on providers)
wazuh-manager.tgz	The manager's state: agent keys and registrations, groups
indexer-snapshot.tgz	The indexer's data: alerts and archived events, vulnerability and inventory state, agent and enrolment records, Pallas conversations, patch jobs and history, accepted risks, verified findings, scanner results
theseus.env	Every setting and generated secret
runtime.tgz	runtime/: certificates and the CA, the agent job-signing key, connector credentials, licence

Each server holds what runs on it: on a two-server installation the core's backup has the manager and the indexer, the application server's the databases.

The backup contains every secret

Anyone with the file can impersonate your stack to its agents and read its credentials. Store it encrypted, off the server, with restricted access.

What it does not save

The vulnerability vendor feeds (downloaded again within a day), monitoring statistics and container logs.

Schedule it

Example cron entry on the server, daily at 02:30, keeping 14 days:

30 2 * * * cd /opt/theseus && ./theseus backup /srv/backup/theseus >/dev/null 2>&1 && find /srv/backup/theseus -name 'theseus-*.tar.gz' -mtime +14 -delete

Copy the files off the server. The indexer snapshot makes the file large: size the destination for your event volume.

Restore

cd /opt/theseus && sudo ./theseus restore /srv/backup/theseus/theseus-<timestamp>.tar.gz

The checksums are verified first; the stack stops, every part is restored (indices of the same name are replaced), and the stack starts and waits until every service is healthy. Restore onto the same release version (it warns otherwise) and the same role. On two servers, restore the core first.

Managed backup

With the backup add-on on the licence, your provider takes encrypted backups of every server from the Theseus control plane, keeps them off your infrastructure and can restore them, including onto new servers. Ask your provider for the schedule and retention.