메뉴
THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10).
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | thor-lens |
| description | THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10). |
THOR Lens is a forensic timeline viewer that transforms THOR v11 audit trail files into an interactive exploration interface.
Critical Boundary:
# 1. Clone and build
git clone https://github.com/NextronSystems/thor-lens.git
cd thor-lens
make build
# 2. Import an audit trail
./thorlens import --log /path/to/audit.jsonl --case mycase
# 3. Serve and open browser
./thorlens serve --case ./cases/mycase --port 8080
# Open http://127.0.0.1:8080
| Item | Value |
|---|---|
| Upstream repo | https://github.com/NextronSystems/thor-lens |
| Default port | 8080 |
| Case storage | ./cases/<name>/ |
| Input format | JSONL (.jsonl or .jsonl.gz) |
| MCP stdio | ./thorlens serve --case <path> --mcp-stdio |
| MCP HTTP | http://localhost:8080/mcp (default) |
--virtual-map and -j during THOR scans to preserve path/hostname contextEntry point and router for THOR-related work: running scans, analyzing THOR logs, troubleshooting THOR behavior, maintaining THOR installs, THOR Lens workflows, writing THOR plugins (v11+), and creating custom signatures/IOCs.
Create and deploy custom IOCs, YARA rules, Sigma rules, and STIX indicators for THOR scans.
Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.
Write, package, and use THOR plugins to extend scanner functionality. THOR v11+ only.
Troubleshoot THOR runs that are stuck, slow, failing to start, stopping early, or produce missing output. Use when the user reports freezes, long runtimes, high CPU pauses, scan aborts, or licensing/update issues.
Interpret THOR scan results and explain what findings mean. Use when the user pastes THOR log lines, shares a log file, or asks how to triage Notices/Warnings/Alerts.