FAQ

Deployment

Can Schildmark run on ARM servers? No. The server must be x86-64. Endpoints can be ARM (Linux arm64, Apple silicon).

Can I use an existing Docker installation? Yes, Docker Engine 24 or later is kept. Older versions must be upgraded first.

Can I use an IP address instead of a domain? Yes. The stack then uses its own CA; browsers warn until you trust it. Let's Encrypt needs a domain.

Which ports must be open? 443 and 1514 inbound (80 for Let's Encrypt and the redirect), and outbound HTTPS to the control plane. See Network and firewall.

Does the control plane need to reach into my network? No. The Leitstand node only connects out.

What happens if the connection to the control plane is down? The stack keeps running. Configuration changes wait. After 7 days without contact the licence lease runs out and the stack accepts one agent until it reconnects; nothing is deleted.

Can I move from one server to two later? Not by a setting. Plan it with us.

Endpoints

Do endpoints need inbound ports? No. They connect out to 443 and 1514.

Can I enrol a machine without patching and add patching later? Yes: run the install command again with --patching (-Patching on Windows). Any valid token works, and it costs no extra token place.

Do disabled agents count towards my licence? Yes. Remove an agent to free its place.

Can I deploy the Windows agent with Intune or Group Policy? Yes, with the Schildmark Agent MSI (pilot); see Windows mass rollout.

I reinstalled an endpoint's operating system. How do I enrol it again? Remove the old agent on the Agents page, then enrol with a token as for a new machine.

Data and AI

Is my alert data sent to you? Not for a self-hosted stack: only health, versions and the agent list. See Security and data flows.

Which LLMs work with Schildmark Analyst? Any OpenAI-compatible endpoint: Hugging Face's router, vLLM, Ollama's /v1, Azure OpenAI and others. Without one, Schildmark Analyst and AI features are unavailable; the rest of the console works.

Where are backups of alert history?./theseus backup does not include the indexer. Use an OpenSearch snapshot repository; see Backup.

Operations

How do I upgrade? From the control plane: each server backs up, switches to the new release, checks every service and rolls back on its own if one is unhealthy. See Upgrade.

Where are the logs?./theseus logs <service>. See Status and logs.