Configuration settings

Every Theseus server keeps its settings in one file, theseus.env, in the stack directory (/opt/theseus on servers installed with an install command). This page lists every setting you or your provider may set.

• Managed by your provider. When your stack is connected to the Theseus control plane, the settings in the first part of this page are managed there and applied to your server. Ask your provider to change them: a local edit to a setting the provider manages is replaced the next time configuration is applied. See Change configuration.
• Set in the console. Integrations (Cloudflare, AWS, Microsoft, Sophos, threat intel, e-mail, Jira, the network sensor, the AI model) are set up by your administrator under Admin → Integrations and applied within a minute; see Integrations.
• Set locally. On a stack you run yourself, edit theseus.env and run ./theseus config apply.
• Secrets are write-only in the provider's form, and masked by ./theseus config show.

Types: text, number, bool (true / false), list (comma-separated), secret (text that is never shown back).

Modules

Optional parts of the stack. The core (Wazuh, the console, sign-in, enrolment, health checks) is always on. Enable modules with ./theseus modules enable <module>, or ask your provider.

Module	Name	What it adds
patch	Patch management	Patch jobs through the Theseus agent; machines opt in per enrolment token.
scanner	External scanner	Nuclei attack-surface scans and their findings in Wazuh.
ai	Pallas AI analyst	Needs an LLM endpoint (AI section).
jira	Jira sync	Pallas incidents to Jira. Needs Pallas and the Jira settings.
reporting	Scheduled reports	SIEM, NIDS, compliance and vendor reports by e-mail.
cloudflare	Cloudflare connector	Cloudflare firewall and WAF events and actions.
defender	Microsoft Defender	Defender for Endpoint connector.
intune	Microsoft Intune	Intune device connector.
sophos	Sophos Central	Sophos Central connector.

The four vendor connectors (cloudflare, defender, intune, sophos) are switched on when they are set up in Admin → Integrations; see Integrations.

Installation

Setting	Type	Default	Meaning
TENANT_NAME	text	default	Short id: lowercase letters, digits and dashes. Stamped on enrolments, reports and alerts; the licence is checked against it. At most 41 characters (the installer and the provider's form apply the same limit). Pattern ^[a-z0-9][a-z0-9-]{0,40}$.
THESEUS_HOST	text		DNS name or IP that browsers and agents use, for example soc.acme.com. Required.
TLS_MODE	one of internal, acme	internal	internal: the stack's own CA. acme: Let's Encrypt (needs public DNS and the e-mail below). Besides internal and acme (above), upstream is set automatically when a cloud gateway terminates TLS in front of the stack.
ACME_EMAIL	text		Used when TLS_MODE=acme.
GATEWAY	one of builtin, aws, azure, gcp, cloudflare	builtin	builtin unless a cloud load balancer or Cloudflare Tunnel fronts the stack.
AGENT_HOST	text	THESEUS_HOST	Where Wazuh agents connect, when it differs from the public host name.
HTTPS_PORT	number	443	Host port for the console, sign-in, Pallas, the SIEM, agent installers and the Theseus agent API (built-in gateway).
HTTP_PORT	number	80	Host port for the HTTP-to-HTTPS redirect and Let's Encrypt validation.
HTTPS_PUBLISH	text		Where the console is published on the host when an edge router owns port 443, e.g. 127.0.0.1:8443. The public URL keeps the HTTPS port above.
EDGE_PROXY_PROTOCOL	bool	false	On when an edge router in front passes the visitor's address in a PROXY v2 header (deploy/gcp/edge).
AGENT_PORT	number	1514	Host port Wazuh agents connect to (TCP).
ADMIN_EMAIL	text		E-mail of the first administrator. Stack health alerts go here unless ALERT_EMAIL is set.
INDEXER_HEAP	text	1g	About half the RAM given to the indexer, for example 4g.

AI (Pallas)

Setting	Type	Default	Meaning
LLM_BASE_URL	text		OpenAI-compatible base URL, for example https://router.huggingface.co/v1.
LLM_MODEL	text		Model name the endpoint serves. Used by Pallas, AI triage, report summaries and the patch planner.
LLM_API_KEY	secret		API key for the LLM endpoint. Empty for a local endpoint that needs none.
LLM_BILL_TO	text		Hugging Face organisation billed for router calls (sent as X-HF-Bill-To).
LLM_ROUTER_MODEL	text		Optional smaller model for routing.
LLM_AGENT_MODEL	text		Model for Pallas's agent steps, when it should differ from LLM_MODEL.
POLICY_ENGINE_LLM_ENABLED	bool	false	Advisory LLM triage in the policy engine.

AWS perimeter

Setting	Type	Default	Meaning
PERIMETER_VENDORS	text		Where the console blocks: any of aws, azure_nsg, cloudflare, do_firewall, fortigate, gcp_vpc, opnsense, sophos_fw, comma-separated (for example aws,sophos_fw). Empty: nowhere. Pattern ^(aws|azure_nsg|cloudflare|do_firewall|fortigate|gcp_vpc|opnsense|sophos_fw)(,(aws|azure_nsg|cloudflare|do_firewall|fortigate|gcp_vpc|opnsense|sophos_fw))*$.
POLICY_ENGINE_TRUSTED_XFF_SOURCES	text		CIDRs whose X-Forwarded-For a network sensor's alert may name the attacker by (for example a CDN's ranges). Empty: private networks only. *: any source (spoofable).
AWS_REGION	text		Setting a region turns the AWS console modules on.
AWS_ACCESS_KEY_ID	text		Access key, when not using a role.
AWS_SECRET_ACCESS_KEY	secret		Secret of the access key.
AWS_ASSUME_ROLE_ARN	text		Preferred over keys: a role in the client's account.
WAF_WEB_ACL_NAME	text		AWS WAF Web ACL the console manages. Needed for WAF blocking.
WAF_WEB_ACL_ID	text		Web ACL id, in place of or in addition to the name.
WAF_BLOCKLIST_IP_SET_NAME	text	Blocked	IP set that holds blocked addresses.
WAF_BLOCKLIST_IP_SET_ID	text		Id of that IP set.
NETWORK_FW_RULE_GROUP_NAME	text		AWS Network Firewall rule group. Needed for layer 3/4 blocking.
AWS_TELEMETRY_SERVICES	text		Comma-separated: cloudtrail, guardduty, waf, inspector, network_firewall. Each one listed is collected into the AWS page.
AWS_TELEMETRY_ROLE_ARN	text		A read-only role for log collection; empty: the role to assume above.
AWS_LOGS_BUCKET	text		S3 bucket with the CloudTrail, GuardDuty and WAF logs (or one bucket each below).
AWS_CLOUDTRAIL_BUCKET	text		CloudTrail bucket
AWS_CLOUDTRAIL_PREFIX	text		CloudTrail prefix
AWS_GUARDDUTY_BUCKET	text		GuardDuty bucket
AWS_GUARDDUTY_PREFIX	text		GuardDuty prefix
AWS_WAF_BUCKET	text		WAF logs bucket
AWS_WAF_PREFIX	text		WAF logs prefix
AWS_NFW_LOG_GROUP	text		The CloudWatch Logs group of the firewall's alert logs.
AWS_TELEMETRY_INTERVAL	text	10m	Collection interval

Microsoft 365 audit logs

Setting	Type	Default	Meaning
O365_TENANT_ID	text		Entra ID tenant of the organisation.
O365_CLIENT_ID	text		An Entra ID app with the Office 365 Management API permission ActivityFeed.Read.
O365_CLIENT_SECRET	secret		Client secret
O365_SUBSCRIPTIONS	text		Comma-separated; empty: Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All.

Cloudflare

Setting	Type	Default	Meaning
CF_API_TOKEN	secret		Cloudflare API token for response actions in the console.
CF_ZONE_ID	text		Cloudflare zone.
CF_ACCOUNT_ID	text		Cloudflare account.

Firewall and network logs (syslog)

Setting	Type	Default	Meaning
SYSLOG_ALLOWED_IPS	text		IPv4 addresses or networks, comma-separated; the manager accepts syslog on UDP 514 from these only.
SYSLOG_BIND	text		Where the server publishes UDP 514: 0.0.0.0 while devices send logs, empty otherwise (not published).

Sophos Firewall

Setting	Type	Default	Meaning
SOPHOS_FW_URL	text		The admin and API address the stack reaches, for example https://10.0.0.1:4444.
SOPHOS_FW_USERNAME	text		API administrator
SOPHOS_FW_PASSWORD	secret		Password
SOPHOS_FW_BLOCK_GROUP	text		The IP host group the firewall drops traffic from and to; empty: Athena-Blocked.
SOPHOS_FW_VERIFY_TLS	bool		Check the firewall certificate

FortiGate

Setting	Type	Default	Meaning
FORTIGATE_URL	text		The HTTPS admin address the stack reaches, for example https://10.0.0.1.
FORTIGATE_API_TOKEN	secret		API token
FORTIGATE_VDOM	text		The virtual domain of the address group; empty: root.
FORTIGATE_BLOCK_GROUP	text		The address group the deny policies use; empty: Athena-Blocked.
FORTIGATE_VERIFY_TLS	bool		Check the FortiGate certificate

OPNsense

Setting	Type	Default	Meaning
OPNSENSE_URL	text		The web interface address the stack reaches, for example https://10.0.0.1.
OPNSENSE_API_KEY	text		API key
OPNSENSE_API_SECRET	secret		API secret
OPNSENSE_ALIAS	text		The Host(s) alias the block rules use: letters, digits and _ only; empty: Athena_Blocked.
OPNSENSE_VERIFY_TLS	bool		Check the OPNsense certificate

Azure network security group

Setting	Type	Default	Meaning
AZURE_NSG_TENANT_ID	text		Tenant id
AZURE_NSG_CLIENT_ID	text		Client id
AZURE_NSG_CLIENT_SECRET	secret		Client secret
AZURE_NSG_SUBSCRIPTION_ID	text		Subscription id
AZURE_NSG_RESOURCE_GROUP	text		Resource group
AZURE_NSG_NAME	text		Network security group
AZURE_NSG_PRIORITY	number		Priority of Athena's first deny rule (100 to 4091); empty: 100.

DigitalOcean Cloud Firewall

Setting	Type	Default	Meaning
DO_API_TOKEN	secret		API token
DO_FIREWALL_ID	text		Firewall id

Google Cloud

Setting	Type	Default	Meaning
GCP_PROJECT_ID	text		The Google Cloud project, for example acme-prod-123456. Pattern ^[a-z][-a-z0-9.:]{3,62}[a-z0-9]$.
GCP_SA_KEY	secret		Base64 of the service account's JSON key, on one line (base64 -w0 key.json). Empty: the VM's own service account (blocking only).
GCP_VPC_NETWORK	text		The network to block in, for example default; Shared VPC: projects/<host-project>/global/networks/<name>.
GCP_FW_TARGET_TAGS	text		Comma-separated network tags the block rules apply to; empty: every instance in the network.
GCP_FW_PRIORITY	number		Priority of the athena-block rules; empty: 100 (before the usual allow rules at 1000).
GCP_PUBSUB_SUBSCRIPTION	text		The subscription of the topic the log sink exports to; Cloud Audit Logs and Security Command Center findings are collected from it.

Microsoft Defender for Endpoint

Setting	Type	Default	Meaning
DEFENDER_TENANT_ID	text		Entra ID tenant of the organisation.
DEFENDER_CLIENT_ID	text		An Entra ID app with the Defender for Endpoint API (WindowsDefenderATP) read permissions and Microsoft Graph security incidents read.
DEFENDER_CLIENT_SECRET	secret		Client secret
DEFENDER_API_HOST	text	api.security.microsoft.com	Host name only; empty: api.security.microsoft.com. Pattern ^[A-Za-z0-9.-]{1,253}$.

Microsoft Intune

Setting	Type	Default	Meaning
INTUNE_TENANT_ID	text		Entra ID tenant of the organisation.
INTUNE_CLIENT_ID	text		An Entra ID app with the Microsoft Graph DeviceManagement*.Read.All, Policy.Read.All and User.Read.All application permissions.
INTUNE_CLIENT_SECRET	secret		Client secret

Sophos Central

Setting	Type	Default	Meaning
SOPHOS_CLIENT_ID	text		A Sophos Central API credential (Global settings, API credentials management).
SOPHOS_CLIENT_SECRET	secret		Client secret
SOPHOS_TENANT_ID	text		Empty: the credential's own tenant.
SOPHOS_TENANT_NAME	text	default	The name events are labelled with.
SOPHOS_API_HOST	text		Empty: found from the credential. Set it for a partner or organisation credential, for example https://api-eu01.central.sophos.com. Pattern ^https://[A-Za-z0-9.-]{1,253}(:[0-9]{1,5})?/?$.

E-mail and alerts

Setting	Type	Default	Meaning
SMTP_HOST	text		Mail server for alerts, reports and password resets.
SMTP_PORT	number	587	Mail server port.
SMTP_USERNAME	text		Mail server user.
SMTP_PASSWORD	secret		Mail server password.
SMTP_FROM	text		Sender address.
SMTP_USE_TLS	bool	true	Use STARTTLS.
SMTP_USE_SSL	bool	false	TLS from the first byte, usually port 465, instead of STARTTLS.
ALERT_EMAIL	text	ADMIN_EMAIL	Where stack health alerts (DOWN, STILL DOWN, RECOVERED) are sent.
ALERT_WEBHOOK	secret		Webhook that receives the same health alerts as JSON.

Threat intel

Setting	Type	Default	Meaning
ABUSEIPDB_API_KEY	secret		Threat intel enrichment.
VIRUSTOTAL_API_KEY	secret		Threat intel enrichment.
OTX_API_KEY	secret		AlienVault OTX enrichment.
MISP_URL	text		Your MISP instance.
MISP_API_KEY	secret		MISP key.
NVD_API_KEY	secret		NVD API key for vuln-verify (higher rate limits).
NUCLEI_TARGET_ALLOWLIST	text		CIDRs and host suffixes the scanner may touch.

Jira

Setting	Type	Default	Meaning
JIRA_BASE_URL	text		Your Jira Cloud URL (jira module).
JIRA_CLIENT_ID	text		Jira OAuth client.
JIRA_CLIENT_SECRET	secret		Jira OAuth secret.
JIRA_CLOUD_ID	text		Jira Cloud site id.
JIRA_PROJECT_KEY	text		Project that receives Pallas incidents.
JIRA_WEBHOOK_SECRET	secret		Secret of the Jira webhook Theseus receives.

Hosted services coming soon

Hosted Pallas and hosted patching are not available yet. These settings exist for the work in progress; leave them at their defaults (stack).

Setting	Type	Default	Meaning
PALLAS_MODE	one of stack, hosted	stack	stack: on the tenant's servers. hosted: in our environment, through the link (needs the hosted Pallas add-on).
PATCH_MODE	one of stack, hosted	stack	stack: on the tenant's servers. hosted: patch service and verification in our environment, through the link (needs the hosted patching add-on).
LINK_HUB_ADDR	text		Host and port of our environment's link entry, for example link.example.com:9444. Pattern ^[A-Za-z0-9.\[\]:-]+:[0-9]{1,5}$.
LINK_SERVER_NAME	text		Name the tenant's link asks for. Empty: <tenant id>.link.theseus.internal. Pattern ^[a-z0-9][a-z0-9.-]{0,252}$.
LINK_HUB_PIN	text		Pin of our side's link certificate, sha256//<base64>. Set with the link credentials. Pattern ^sha256//[A-Za-z0-9+/]{43}=$.

NIDS sensor

Setting	Type	Default	Meaning
NIDS_ENABLED	bool	false	A Suricata NIDS sensor reports to this stack; shows the NIDS pages.
SURICATA_AGENT_URL	text		URL of the sensor's agent.
SURICATA_AGENT_TOKEN	secret		Token for the sensor's agent.

Data retention

Setting	Type	Default	Meaning
LOG_RETENTION_DAYS	number	45	Days of alerts and network events the indexer keeps (its retention policy deletes older daily indices); 7 to 3650. SOC 2 and HIPAA audits usually expect 365. Set by the tenant's admin in the console (Admin -> Integrations -> Data retention).

Topology, gateway and images

Set by the installer or by your provider. Change them only when you are told to; most need a re-install rather than config apply.

Setting	Type	Default	Meaning
ADMIN_USERNAME	text	admin	User name of the first administrator. Lowercase letters, digits, ., _, -; 2 to 40 characters.
COMPOSE_PROFILES	list		Enabled modules. Change it with ./theseus modules, not by hand.
TRUSTED_PROXY_CIDRS	list		Proxies allowed to set the client address on the upstream listener (cloud gateways). Empty for builtin.
UPSTREAM_HTTP_PORT	number	8088	Plain-HTTP listener a cloud gateway forwards to. Bound to loopback unless GATEWAY is a cloud mode.
CLIENT_IP_HEADER	text		Header carrying the client address behind a gateway: X-Forwarded-For, or CF-Connecting-IP for Cloudflare.
GATEWAY_REQUIRE_HEADER	text		Azure Front Door only: X-Azure-FDID: <profile id>. Requests on the upstream listener without it are refused.
AGENT_VERSION	text	4.14.0-1	Wazuh agent version the endpoint installers deploy.
WAZUH_VERSION	text	4.14.0	Wazuh core version.
BRAND	text	athena	Dashboard brand layer.
THESEUS_ROLE	one of all, core, app	all	all, core or app. Fixed at install time.
CORE_HOST	text		app machine only: the core machine's private address (IP, or a name this host resolves).
CORE_BIND	text		core machine only: its own private address. 9200, 55000, 5601 and 9001 are published there for the app machine.
THESEUS_REGISTRY_HOST	text		Release installs: host[:port] of the registry the images are pulled from. Written by the install; do not edit.

More optional settings

Read by the stack from theseus.env but not offered in the provider's settings form. Defaults are those in deploy/compose.yml.

Setting	Type	Default	Meaning
REPORT_TZ	text	UTC	Time zone of the reporting schedule (reporting module).
REPORT_LLM_ENABLED	bool	false	LLM-written summaries in scheduled reports.
SCANNER_REPORT_LLM_ENABLED	bool	false	LLM-written summaries in scanner reports.
PATCH_LLM_ENABLED	bool	false	LLM assistance in the patch planner.
PATCH_ENVIRONMENT_DEFAULT	text	prod	Environment of a patch target that has none (also given to machines enrolled for patching). Unattended approval matches on environment and allows test by default, so with the defaults a machine without an environment is never approved unattended.
IDLE_TIMEOUT_MINUTES	number	30	Console sign-out after this many idle minutes.
KEYCLOAK_SELF_SERVICE_PASSWORD_RESET	bool	false	"Forgot password" on the sign-in page. Needs SMTP.
KEYCLOAK_MEMORY_LIMIT	text	1408m	Memory limit of the Keycloak container.
REPLICA_URL	text		ops: copy alerts to another OpenSearch cluster. With REPLICA_USERNAME, REPLICA_PASSWORD.
REPLICA_PATTERNS	text	wazuh-alerts-*	Index patterns the replication copies.
OPS_CHECK_INTERVAL_SECONDS	number	60	ops: seconds between stack health checks.
OPS_STRIKES_TO_ALERT	number	3	ops: failed checks in a row before a DOWN alert is sent.
OPS_REMINDER_MINUTES	number	60	ops: minutes between STILL DOWN reminders while a check keeps failing.
OPS_REPLICA_INTERVAL_SECONDS	number	300	ops: seconds between replication runs (with REPLICA_URL).
REPORT_SIEM_ENABLED	bool	true	false turns off the scheduled SIEM report (reporting module).
REPORT_SURICATA_ENABLED	bool	true	false turns off the scheduled NIDS (Suricata) report (reporting module).
REPORT_COMPLIANCE_ENABLED	bool	true	false turns off the scheduled compliance report (reporting module).
REPORT_AGENTS_ENABLED	bool	true	false turns off the scheduled agent status and vulnerability report (reporting module).
REPORT_HIGH_PRIORITY_ENABLED	bool	true	false turns off the scheduled high-priority vulnerability report (reporting module).
REPORT_GCP_ENABLED	bool	true	false turns off the scheduled GCP report (reporting module).
REPORT_CLOUDFLARE_ENABLED	bool	true	false turns off the scheduled Cloudflare report (reporting module).
REPORT_SOPHOS_ENABLED	bool	true	false turns off the scheduled Sophos Central report (reporting module).
REPORT_CLAMAV_ENABLED	bool	true	false turns off the scheduled ClamAV endpoint report (reporting module).
REPORT_INCIDENT_ENABLED	bool	true	false turns off the scheduled incident report (reporting module).
AWS_ENDPOINT_URL	text		Sends every AWS call of the console to another endpoint. Empty means real AWS.
AWS_EMULATOR	bool	false	Test installations only: runs an AWS emulator in place of AWS so the perimeter pages can be tried without an account.
LOG_LEVEL	text	INFO	Console backend log level.

Derived settings

Written by ./theseus config apply and by the install. Do not edit them; config merge refuses them.

PUBLIC_URL, PATCH_ENABLED, AGELEIA_MODULES, WEB_TLS_PIN_SHA256, WEB_TLS_CERT_SHA1, WEB_CA_FILE, AGENT_JOB_PUBKEY, UPSTREAM_BIND, THESEUS_RELEASE, THESEUS_VERSION, IMAGE_<NAME>.

Generated secrets

Generated once by the install and kept on every re-run. They never leave your server, except to your provider's control plane, sealed, when your provider installs the stack (so that a second server or a re-install can use them). They are not settings: do not change them in theseus.env. Indexer passwords take effect only on a fresh security index; manager API and database passwords live in their own stores.

Group	Keys
Indexer	INDEXER_ADMIN_PASSWORD, INDEXER_SVC_PASSWORD, INDEXER_ENROLL_PASSWORD, KIBANASERVER_PASSWORD
Wazuh manager	WAZUH_API_PASSWORD, WAZUH_ENROLL_API_PASSWORD, WAZUH_AUTHD_PASSWORD, WAZUH_CLUSTER_KEY
Console and sign-in	POSTGRES_PASSWORD, REDIS_PASSWORD, KEYCLOAK_DB_PASSWORD, KEYCLOAK_ADMIN_PASSWORD, KEYCLOAK_CLIENT_SECRET, KEYCLOAK_BACKEND_NODE_SECRET, SECRET_KEY
Service to service	INTEGRATION_API_KEY, PALLAS_SERVICE_API_KEY, PALLAS_WS_TICKET_SECRET, PALLAS_IFRAME_HMAC_SECRET, NUCLEI_API_KEY, PATCH_API_TOKEN, ENROLL_ADMIN_TOKEN

The agent job-signing key is runtime/pki/agent/jobs.key. Vendor connector credentials are in runtime/connectors/<name>.json.