Glossary

Term	Meaning
Agent address (AGENT_HOST)	Where monitoring agents connect on TCP 1514. By default the console address
app	The role of the application server in a two-server install: gateway, console, sign-in, enrolment, patching, Schildmark Analyst
Campaign	A patch rolled out over rings of hosts in order, halting on failures
Connector	A container that pulls a vendor's events (Cloudflare, Defender, Intune, Sophos) into the manager
Control plane	Our service that holds each customer's configuration and licence and drives the Leitstand node. Messages in your terminal call it the Leitstand
core	The role of the engine server in a two-server install: manager, indexer, dashboard, vuln-verify, scanner, connectors
Dry run	Rehearsal of a patch on the machine without changing it
Engine	The SIEM core of a stack: the manager, the indexer and the SIEM dashboard
Enrolment token (THS-...)	Lets machines install agents and register. Limited in machines and time
Held by licence	An agent disabled automatically because the stack is over its licence's agent limit
Indexer	The search store that holds alerts, inventory, vulnerability findings and the services' state
Install token (TND-...)	The token in a server install command. One server, 24 hours
Internal CA	The certificate authority your stack creates for itself (TLS_MODE=internal)
Leitstand node	The service on each server that connects out to the control plane
Manager	The engine service that receives monitoring agent events, applies the ruleset and raises alerts
Module	An optional part of the stack (patch, scanner, ai, jira, reporting, connectors)
Monitoring agent	The endpoint agent that sends events to the manager
Probe	A health check of one part of the stack, shown by ./theseus status and Platform health
Protected IPs	Addresses never blocked at the perimeter
Release	A Schildmark version: a bundle of files and a set of images pinned by digest
Remediated	A patch job whose fix vuln-verify confirmed independently
Role	What a server runs: all, core or app
Schildmark Agent	The endpoint agent for patching. Optional
Schildmark Analyst	The AI SOC analyst
Schildmark Console	The console at https://<your domain>/
SIEM dashboard	The engine's search and dashboard interface at https://<your domain>/siem/
Stack	The set of containers that is one Schildmark installation
Stack directory	Where ./theseus and theseus.env live; /opt/theseus by default
theseus.env	The stack's settings and generated secrets
vuln-verify	The service that corroborates the engine's vulnerability findings and confirms fixes