Backup

What a backup saves

cd /opt/theseus && sudo ./theseus backup            # into ./backups/
sudo ./theseus backup /srv/backup/schildmark           # or a directory of your choice

It writes one file, theseus-<UTC timestamp>.tar.gz (mode 0600), with a manifest.json that records each part's checksum:

Part	Contents
app-db.dump	The console database: configuration, roles and page grants, audit log, mutes, policy rules
keycloak-db.dump	Users, passwords and sign-in configuration (including single sign-on providers)
wazuh-manager.tgz	Manager's state: agent keys and registrations, groups
indexer-snapshot.tgz	Indexer's data: alerts and archived events, vulnerability and inventory state, agent and enrolment records, Schildmark Analyst conversations, patch jobs and history, accepted risks, verified findings, scanner results
theseus.env	Every setting and generated secret
runtime.tgz	runtime/: certificates and the CA, the agent job-signing key, connector credentials, licence

Each server holds what runs on it: on a two-server installation the core's backup has the manager and the indexer, the application server's the databases.

The backup contains every secret

Anyone with the file can impersonate your stack to its agents and read its credentials. Store it encrypted, off the server, with restricted access.

What it does not save

The vulnerability vendor feeds (downloaded again within a day), monitoring statistics and container logs.

Schedule it

Example cron entry on the server, daily at 02:30, keeping 14 days:

30 2 * * * cd /opt/theseus && ./theseus backup /srv/backup/schildmark >/dev/null 2>&1 && find /srv/backup/schildmark -name 'theseus-*.tar.gz' -mtime +14 -delete

Copy the files off the server. The indexer snapshot makes the file large: size the destination for your event volume.

Restore

cd /opt/theseus && sudo ./theseus restore /srv/backup/schildmark/theseus-<timestamp>.tar.gz

The checksums are verified first; the stack stops, every part is restored (indices of the same name are replaced), and the stack starts and waits until every service is healthy. Restore onto the same release version (it warns otherwise) and the same role. On two servers, restore the core first.

Managed backup

With the managed backup add-on on the licence (talk to sales to add it), we take backups of every server from our control plane and keep them off your infrastructure, in our storage:

• Encrypted on your server before they leave it (AES-256-GCM, a new key for every backup). Your servers never hold credentials to our storage: each upload uses a short-lived link for that one backup.
• Scheduled daily or weekly at an hour we agree with you, keeping between 1 and 90 backups; older ones are deleted. We can also take one at any time, for example before a change.
• The same parts as ./theseus backup above. On two servers, one backup holds both servers' parts.
• Restored onto the same server, or onto a new one: the new server is installed with the backup's secrets and certificate authority, then the backup is restored onto it. Point your DNS records at the new server.

Ask us for your schedule and retention, or to restore.