What is Theseus

Theseus is an XDR and SOC platform built on Wazuh, packaged as one product. Each customer organisation gets its own stack: a set of containers on one server (or two), with its own data, its own sign-in and its own certificates. Endpoints run the Wazuh agent and, optionally, the Theseus agent for patching.

Components

Component	What it does
Core	The official Wazuh manager, indexer and dashboard images (Wazuh 4.14), a brand layer on the dashboard, and the Athena ruleset. Collects and correlates endpoint and vendor events.
Ageleia	The main console: alerts, vulnerabilities, patching, response and policy engine, compliance, agents, integrations, users and onboarding.
Pallas	The AI SOC analyst: natural-language investigations over your alerts, triage, incidents. Optional (ai module).
Enrolment	One token and one command per endpoint installs the Wazuh agent and, when the token includes patching, the Theseus agent.
Theseus agent	A small endpoint agent for patching. Outbound HTTPS only, signed requests, signed jobs, a fixed list of actions. Optional.
Patch service and vuln-verify	vuln-verify corroborates Wazuh's vulnerability findings; the patch service turns a verified finding into a planned, rehearsed, approved and verified patch job.
Scanner	External attack-surface scans with Nuclei; findings go into Wazuh. Optional (scanner module).
Connectors	Cloudflare, Microsoft Defender, Microsoft Intune and Sophos Central events into Wazuh. Optional, one module each.
Reporting	Scheduled reports and e-mail digests. Optional (reporting module).
Ops	Health probes for every part of the stack, and e-mail or webhook alerts when something stays down.
Gateway	One HTTPS address for everything, served by Caddy on your server, or by a cloud load balancer or Cloudflare Tunnel in front of it.
theseus-node	A small service on each server that connects out to the Theseus control plane: it installs the stack, applies the configuration your provider sets, keeps the licence current and reports health.

The Architecture page shows how they connect.

What you work with

• The console at https://<your domain>/. Analysts sign in with accounts an administrator creates. See Tour of the console.
• The ./theseus command on the server, for status, logs, modules and backups. See theseus CLI.
• Endpoints, enrolled with one command per machine from the console. See Enrol endpoints.

Modules

The core (Wazuh, console, sign-in, enrolment, health) is always on. These modules are optional:

Module	Adds
patch	Patch management through the Theseus agent
scanner	External scanner (Nuclei)
ai	Pallas AI analyst; needs an LLM endpoint
jira	Pallas incidents synchronised to Jira; needs ai
reporting	Scheduled e-mail reports
cloudflare, defender, intune, sophos	One vendor connector each

Next

• Deployment options: where Theseus can run.
• Requirements: what the server needs.