Glossary

Term	Meaning
Ageleia	The Theseus console at https://<your domain>/
Agent address (AGENT_HOST)	Where Wazuh agents connect on TCP 1514. By default the console address
app	The role of the application server in a two-server install: gateway, console, sign-in, enrolment, patching, Pallas
Campaign	A patch rolled out over rings of hosts in order, halting on failures
Connector	A container that pulls a vendor's events (Cloudflare, Defender, Intune, Sophos) into Wazuh
Control plane	Our service that holds each customer's configuration and licence and drives theseus-node. Messages in your terminal call it Daedalus
core	The role of the Wazuh server in a two-server install: manager, indexer, dashboard, vuln-verify, scanner, connectors
Dry run	Rehearsal of a patch on the machine without changing it
Enrolment token (THS-...)	Lets machines install agents and register. Limited in machines and time
Held by licence	An agent disabled automatically because the stack is over its licence's agent limit
Install token (TND-...)	The token in a server install command. One server, 24 hours
Internal CA	The certificate authority your stack creates for itself (TLS_MODE=internal)
Module	An optional part of the stack (patch, scanner, ai, jira, reporting, connectors)
Pallas	The AI SOC analyst
Probe	A health check of one part of the stack, shown by ./theseus status and Platform health
Protected IPs	Addresses never blocked at the perimeter
Release	A Theseus version: a bundle of files and a set of images pinned by digest
Remediated	A patch job whose fix vuln-verify confirmed independently
Role	What a server runs: all, core or app
Stack	The set of containers that is one Theseus installation
Stack directory	Where ./theseus and theseus.env live; /opt/theseus by default
Theseus agent	The endpoint agent for patching. Optional
theseus-node	The service on each server that connects out to the control plane
theseus.env	The stack's settings and generated secrets
vuln-verify	The service that corroborates Wazuh's vulnerability findings and confirms fixes
Wazuh agent	The endpoint agent that sends events to the Wazuh manager