Menu
Analyze THOR's SQLite database (thor10.db/thor11.db) for performance tuning, scan timing, resume state, and delta comparisons. Use when investigating slow scans, debugging performance, or understanding what THOR tracked.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | thor-db |
| description | Analyze THOR's SQLite database (thor10.db/thor11.db) for performance tuning, scan timing, resume state, and delta comparisons. Use when investigating slow scans, debugging performance, or understanding what THOR tracked. |
THOR maintains an SQLite database for timing telemetry, scan resume state, and delta comparisons between scans.
--diff modeDisable ThorDB:
# v11
thor64.exe --exclude-component ThorDB -p C:\
# v10
thor64.exe --nothordb -p C:\
Override location (v11):
thor64.exe --thordb-path /custom/path/ -p C:\
Find the database:
# Windows admin
dir C:\ProgramData\thor\thor*.db
# Linux root
ls -la /var/lib/thor/thor*.db
# Linux user
ls -la ~/.local/state/thor/thor*.db
Open with SQLite:
sqlite3 /var/lib/thor/thor10.db
When THOR is slow, check what's taking time:
-- Top time sinks overall
SELECT category, element, count, duration/1e9 AS seconds
FROM times ORDER BY duration DESC LIMIT 20;
Find rules or elements with high average time:
SELECT category, element, count,
(duration*1.0/count)/1e9 AS avg_seconds
FROM times WHERE count >= 5
ORDER BY (duration*1.0/count) DESC LIMIT 20;
Check resume markers and scan metadata:
SELECT key, value FROM tbl ORDER BY key;
Resume requires ThorDB to be enabled and command line arguments to match.
# Resume if state exists, otherwise run full scan
thor64.exe --resume-scan -p C:\
# Resume only if state exists, fail otherwise
thor64.exe --resume-only -p C:\
To clear resume state: run THOR once without --resume-scan.
# Enable resume tracking (required since v10.5)
thor64.exe --resume -p C:\
Since THOR 10.5, resume state is not tracked by default due to performance implications. Start scans with --resume to enable resume capability.
To clear resume state: run THOR once without --resume.
THOR 10 uses thor10.db, THOR 11 uses thor11.db. Older deployments may show thor.db.
# Check binary strings
strings ./thor-linux-64 | grep -E 'thor[0-9]+\.db'
# Or trace file opens during scan
strace -f -e openat ./thor-linux-64 --quick -p /tmp 2>&1 | grep -E 'thor[0-9]+\.db'
Entry point and router for THOR-related work: running scans, analyzing THOR logs, troubleshooting THOR behavior, maintaining THOR installs, THOR Lens workflows, writing THOR plugins (v11+), and creating custom signatures/IOCs.
Create and deploy custom IOCs, YARA rules, Sigma rules, and STIX indicators for THOR scans.
Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.
Write, package, and use THOR plugins to extend scanner functionality. THOR v11+ only.
Troubleshoot THOR runs that are stuck, slow, failing to start, stopping early, or produce missing output. Use when the user reports freezes, long runtimes, high CPU pauses, scan aborts, or licensing/update issues.
THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10).