Appearance
Deployment options
You can run Theseus on your own servers or let us host it. The product is the same in every option; what changes is who runs the servers and where the data lives.
| Self-hosted, one server | Self-hosted, two servers | Hosted by us | |
|---|---|---|---|
| Who runs the servers | You | You | Us |
| Where your data lives | Your server | Your servers | Our infrastructure, one stack per customer |
| Who runs the install | You, with the install command we send | You, two install commands, core first | Us |
| First administrator password | Shown only in your terminal; never sent to us | As one server | Kept sealed by us and handed to you |
| Good for | Most organisations | Larger fleets, or separating Wazuh from the consoles | Teams that do not want to run servers |
| Minimum memory | 8 GB | 6 GB (core) + 4 GB (app) | n/a |
Self-hosted
You prepare a Linux server (or two) that meets the requirements. We create your organisation in our control plane and send you an install command. Run it on the server: it checks the host, installs Docker, installs theseus-node, asks for your console's domain, and installs the stack. When it finishes it prints your console address, the administrator sign-in, the DNS record to create and the ports to open.
After the install, theseus-node keeps a single outbound HTTPS connection to our control plane, which we use to apply configuration you ask for, deliver your licence, and see the stack's health. It needs no inbound access.
- One server: Install on one server.
- Two servers: Install on two servers.
Hosted by us
We install and run the stack for you on our infrastructure, with its own servers. You receive the console address and the first administrator's sign-in. Endpoints enrol exactly as in a self-hosted stack, and still need to reach the stack on 443 and 1514; see Network and firewall.
Optional hosted services coming soon
We are building an option to run two services for a self-hosted stack in our environment instead of on your server:
- Hosted Pallas: the AI analyst with our LLM gateway, so you need no LLM endpoint of your own.
- Hosted patching: the patch service and vuln-verify.
Your users and endpoints would keep using your own stack's address; the stack would forward these services over one outbound encrypted connection. Alert, inventory and vulnerability data the hosted service reads would leave your infrastructure. This option is not available yet. Today Pallas uses the LLM endpoint you configure, and patching runs on your stack.
Without the control plane
A stack can also be installed by hand from a release bundle, without theseus-node. You then do yourself what the control plane does for you (configuration, licence). See Install from a bundle.