Theseus

Appearance

Release notes ​

0.2.15 ​

Included ​

  • Compliance: the page warns when logs are kept shorter than the framework on screen expects: 365 days for PCI DSS (a requirement, 10.5.1), SOC 2, HIPAA, NIST 800-53 and ISO 27001 (a guideline); GDPR sets no minimum. Administrators get Change retention, which opens Admin → Integrations → Data retention. The evidence pack's README.txt names the shortfall (details).
  • Response → Blocked IPs is shown when any blocking point the page lists is set up: Sophos Firewall, AWS or Cloudflare (it needed AWS before). Without one, it says to connect one in Admin → Integrations.

0.2.14 ​

Included ​

  • Blocking on FortiGate, OPNsense, Azure network security groups, DigitalOcean Cloud Firewall and the Google Cloud VPC firewall, set up in Admin → Integrations.
  • Google Cloud logs: Cloud Audit Logs and Security Command Center findings from a Pub/Sub subscription.
  • Sophos Firewall in Response → Blocked IPs: the block group's members, with unblock for Athena's own entries; members added on the firewall are shown and left alone. A read-only check every 15 minutes compares the group with the recorded blocks (details).
  • Compliance page (Overview → Compliance): choose the frameworks you report on (SOC 2, HIPAA, PCI DSS, GDPR, NIST 800-53, ISO 27001), see each control's alerts and failing configuration checks, open a control's evidence, and export an evidence pack (ZIP of CSV files, administrators, audit-logged). See Compliance.
  • Log retention is a setting: Admin → Integrations → Data retention, 7 to 3650 days, default 45 (the fixed period before, so an updated stack keeps its disk use). The Compliance page shows the period and the disk it needs.
  • Add agents (and Get started) show the Windows MSI command line for Intune, Configuration Manager and Group Policy, with a link to download the MSI (Windows mass rollout).
  • Patching settings and Investigation on the new console design: approval policy, rollouts, accepting a risk, and the job panel.
  • Sophos Central: optional API host (data region), for partner and organisation credentials. Email and webhook: implicit TLS (port 465).
  • The console checks each integration field (numbers, true/false, formats) as it is recorded.
  • theseus-node updates itself when your provider offers a new version, and goes back to the previous one if the new one does not start (updates).

Known limitations ​

  • Response → Blocked IPs is shown only when AWS is a perimeter, so a stack with only Sophos Firewall does not see the list in the console (fixed in 0.2.15).
  • FortiGate, OPNsense, Azure network security groups and DigitalOcean Cloud Firewall have no Platform health tile yet: use Test connection in Admin → Integrations.

0.2.13 ​

Included ​

  • Integrations from the console: every integration is set up in Admin → Integrations, with Test connection. The stack applies a saved change within a minute and records it with your provider; no access to the server is needed (Integrations).
  • Sophos Firewall blocking: Athena adds blocked addresses to an IP host group your drop rules use; the Block dialog offers Block on Sophos Firewall (Sophos Firewall).
  • Syslog from network devices: Admin → Integrations → Firewall and network logs (syslog) accepts syslog on UDP 514 from the devices you list; the port is published only while it is set up (Syslog).
  • Platform health shows an integration you have not set up as Not set up, not as a fault.

Changed ​

  • Integration values cannot contain spaces, $, #, quotes or backquotes. If a vendor password has one, give the account a new password without it.

0.2.12 ​

Included ​

  • Patching, machine first: a list of machines (those waiting on a person first) and the selected machine beside it, with what waits on you, what is running, the fixes it can take and its history. Jobs open in the same pane. See Patching.
  • The history shows fixes the verification engine confirmed on a machine that no Athena job made as updated outside Athena, so an automatic update no longer reads as a miss.
  • Patching settings (Patching → Settings): approval policy, rollouts and accepted risks.

Changed ​

  • Patch job steps, errors and notes describe what happened on the machine in plain words; steps of older jobs are relabelled the same way.

0.2.0 to 0.2.4 ​

Fixed ​

  • Patch campaigns can be created from the console (New campaign), and the campaigns panel shows the patch service's real states (Running, Halted, Done) with Approve campaign until someone approves.
  • The Audit log menu item follows the role's page grants: it is shown only to roles granted the audit page (administrators by default).
  • Both Add agents forms propose 25 machines for 7 days and offer agent groups.
  • One token for monitoring and patching: every enrolment token allows patching while the patch module is on, including tokens created earlier without it. Include patching is gone from the Add agents forms; Also enable patching adds --patching (-Patching) to the command shown.
  • The installers' output and errors, and the Add agents forms, describe the agent as the Theseus agent and its monitoring component; installer options are printed with --help (Linux, macOS).
  • The interactive installer accepts tenant ids of up to 41 characters, like the provider's settings form.
  • Patching: a machine without an environment counts as prod everywhere, so it is never approved unattended by default.
  • theseus.env can set the ops check interval, alert strikes and reminder interval, and turn each scheduled report off (REPORT_<NAME>_ENABLED).
  • An LLM endpoint behind your own private CA: put the CA in runtime/pki/extra-ca.pem (details).
  • The GitHub Dependabot rules are no longer loaded: no connector feeds them.

0.1.0 ​

First release of Theseus as one product. Published 27 October 2026. Images for linux/amd64, pinned by digest.

Included ​

  • Core: official Wazuh 4.14.0 manager and indexer images; the Wazuh dashboard with the Athena brand layer; the Athena ruleset.
  • Console (Ageleia): alerts and mutes, vulnerabilities verified by vuln-verify, patching, policy engine, perimeter blocking for AWS and Cloudflare, protected IPs, agents (disable, enable, remove), users and roles, Get started, Platform health.
  • Enrolment: one token and one command per machine for Linux, macOS and Windows, with optional patching; no shared registration password.
  • Theseus agent: outbound-only patching agent with signed requests and signed jobs, replacing the earlier Salt-based channel.
  • Patching: plan, dry run, approval (two approvers for critical machines), install, independent verification; unattended approval policies; maintenance windows; rollout campaigns (created through the API).
  • Pallas: AI analyst with chat, triage and incidents, using your OpenAI-compatible LLM endpoint; optional Jira sync.
  • Scanner: Nuclei external scans with schedules.
  • Connectors: Cloudflare, Microsoft Defender, Microsoft Intune, Sophos Central.
  • Reporting and ops health alerts.
  • Install: one install command per server (Ubuntu 22.04/24.04, Debian 12, RHEL/Rocky/Alma 9, x86-64), single-server and two-server topologies, release bundles, cloud gateway Terraform for AWS, Azure, GCP and Cloudflare.

Known limitations ​

  • No one-click upgrade and no restore command. See Upgrade and Backup.
  • Alert history is not part of ./theseus backup.
  • Windows rollout through Intune or Group Policy is not supported yet.
  • Creating patch campaigns from the console is not available; the campaigns panel shows and controls existing ones.
  • Windows Update, winget, pip and Homebrew patching are pilots.
  • In a two-server install, verification after a patch waits for vuln-verify's regular cycle.
  • The Sophos connector may fail on its first fetch when configured only through the setup prompts (details).
  • Hosted Pallas and hosted patching are not available in this release.
  • The servers must be x86-64.

Theseus documentation