skills.rest
NextronSystems
NextronSystemsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

thor-lens

Import THOR v11 audit trail JSONL files into an interactive forensic timeline UI.

12|2|Updated Jan 17, 2026
Search Tags:#timeline#mcp#forensics#audit-trail#web-ui#thorlens#case-analysis
One-click install
npx skills add https://github.com/NextronSystems/thor-skill --skill thor-lens
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: thor-lens
Source: https://github.com/NextronSystems/thor-skill/tree/main/thor-lens
Command: npx skills add https://github.com/NextronSystems/thor-skill --skill thor-lens

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, numfmt, sqlite3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

THOR Lens provides a web UI to import THOR v11 audit trail JSONL files and transform them into an interactive forensic timeline, helping investigators quickly understand case chronology and relationships.

Core Features & Use Cases

  • Import THOR v11 audit trails and transform them into an interactive timeline.
  • Annotate findings with tags, bookmarks, and comments; browse, filter, and search events; and integrate with Claude Code via MCP.
  • Validate and serve audit trails locally to enable rapid triage, case construction, and AI-assisted analysis.

Quick Start

Clone THOR Lens, build it, import a THOR v11 audit trail with thorlens import, and start the UI with thorlens serve.

Frequently Asked Questions about thor-lens

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I visualize THOR v11 audit trail JSONL files as a forensic timeline?▼

To visualize THOR v11 audit trail JSONL files as a forensic timeline, import the data using the thorlens import command and start the web UI with thorlens serve to explore case chronology interactively.

What is a forensic timeline UI for digital investigations?▼

A forensic timeline UI is a web interface that transforms audit trail data into an interactive chronological view, helping digital investigators quickly browse, filter, and correlate events to construct a case.

Do I need specific tools to run the THOR Lens web UI locally?▼

Yes, running the THOR Lens web UI locally requires jq, numfmt, and sqlite3 installed in your environment to successfully import audit trails and serve the interactive interface.

Can I integrate Claude Code with a digital forensics case timeline?▼

Yes, you can integrate Claude Code with a digital forensics case timeline via MCP to enable AI-assisted analysis, allowing you to annotate findings with tags and comments while querying case events.

What's the best way to triage and filter forensic audit trail events?▼

The best way to triage and filter forensic audit trail events is to import the JSONL data into the THOR Lens UI, where you can browse, search, and annotate findings across time to construct your case.

What limitations exist when analyzing THOR v11 audit trails?▼

A key limitation is that the forensic timeline visualization strictly requires THOR v11 audit trail JSONL output; audit trails from older versions or incompatible formats cannot be imported or analyzed.

Related Skills

Explore More Data & Analytics Skills→
Nextron-LabsNextron-Labs
12

thor-lens

Import THOR v11 JSONL audit trails into a browser-based forensic timeline UI.

Official
Intermediate
rongarederongarede
4

word-to-tex

Convert Word content into LaTeX and write it to a .tex file.

Community
Basic
eggent-aieggent-ai
330

session-logs

Search and analyze JSONL session logs from the local Eggent agent store.

Official
Intermediate
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced