theseus CLI

./theseus is the command that installs and operates a stack. It needs only Docker; everything else runs in containers. Run it from the stack directory (/opt/theseus on servers installed with an install command) as root.

cd /opt/theseus && sudo ./theseus <command>

./theseus help prints the summary.

Install and lifecycle

Command	What it does
install [--non-interactive]	Preflight, setup (questions, or answers from theseus.env and the environment with --non-interactive), images (built from source, or pulled for a release), start, bootstrap (first administrator, enrolment user, index retention). THESEUS_NONINTERACTIVE=1 is the same as the flag
doctor	Preflight checks only: Docker and Compose, role, memory, vm.max_map_count (Linux; THESEUS_SKIP_SYSCTL=1 continues anyway), architecture, ports in use
up [services]	Start the stack (a release pulls this server's images first). Retries once after 30 s if services are slow to become healthy
down	Stop and remove the containers. Data volumes are kept
restart [services]	Recreate the named services (all without names). Recreate, not restart: the Wazuh images apply mounted configuration only on a fresh container
pull	Release mode: pull this server's images
build [services]	Source checkouts only: build service images. A release refuses
core build	Source checkouts only: build the branded Wazuh dashboard image
uninstall	Asks you to type DELETE, then removes the containers and all data volumes. theseus.env and runtime/ are kept

Status and logs

Command	What it does
status	Role, release, containers with state and health, health probes, console address
status --json	The same as one JSON object (used by theseus-node)
ps	Containers only
logs [services]	Follow logs, starting with the last 200 lines
logs-tail <service> <lines>	Print the last lines (at most 500) and exit
agents --json	Enrolled agents as JSON (used by theseus-node)

Configuration

Command	What it does
config show	Print theseus.env with values of keys containing PASSWORD, SECRET, TOKEN or KEY masked
config apply	Re-render runtime/ after editing theseus.env, start what changed, recreate the gateway and Wazuh services
config merge <file>	Set KEY=VALUE lines and remove -KEY lines in theseus.env. Refuses generated secrets, derived settings and COMPOSE_PROFILES. Run config apply afterwards
modules list	Enabled and available modules
modules enable <m...> / modules disable <m...>	Change modules (patch scanner ai jira reporting cloudflare defender intune sophos), then start or stop their services
connectors enable <name>	Without the console: ask for a vendor connector's credentials (cloudflare, defender, intune, sophos), save them to runtime/connectors/<name>.json, enable and start it
connectors disable <name>	Disable a connector (its credentials file is kept)
integrations sync [--json]	Apply what an administrator saved in the console under Admin → Integrations: merge it into theseus.env, switch the modules it implies and restart what uses it. theseus-node runs it every minute; prints one JSON line

Endpoints and accounts

Command	What it does
enroll token [--patching] [--label L] [--groups a,b] [--max N] [--days D]	Create an enrolment token and print the Linux, Windows and macOS install commands. --patching prints them with the patching flag (any token allows patching). Defaults: without the flag, 25 machines, 7 days
admin reset-password	A new temporary password for the first administrator

Data

Command	What it does
backup [DIR]	Database dumps, theseus.env and runtime/ into DIR/theseus-<timestamp>.tar.gz (default backups/). See Backup

Files it uses

Path	What
theseus.env	Settings and generated secrets (mode 0600)
runtime/	Generated files: certificates (runtime/pki), gateway configuration, connector credentials, the licence, role and release overrides
runtime/install-result.json	After a non-interactive install: the first administrator and temporary password (0600)
release.json	Present in a release: version and image digests
deploy/compose.yml	The services