skills.rest
Nextron-Labs
Nextron-LabsOFFICIAL
Explore all skills by this author →
GitHub

thor-lens

Import THOR v11 JSONL audit trails into a browser-based forensic timeline UI.

12|2|Updated Jan 17, 2026
Search Tags:#mcp#import#case-management#audit-trail#web-ui#thorlens#forensic-timeline
One-click install
npx skills add https://github.com/Nextron-Labs/thor-skill --skill thor-lens-nextron-labs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: thor-lens
Source: https://github.com/Nextron-Labs/thor-skill/tree/main/thor-lens
Command: npx skills add https://github.com/Nextron-Labs/thor-skill --skill thor-lens-nextron-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, numfmt, and includes scripts (resource) components.

What problem does it solve?

THOR Lens provides investigators with a browser-based interface to import THOR v11 audit trail JSONL logs and explore forensic timelines interactively.

Core Features & Use Cases

  • Web UI for forensic timeline exploration: Import THOR audit trails and view events in an interactive browser interface.
  • THOR v11 audit-trail compatibility: Requires THOR v11 export; THOR v10 is not supported.
  • MCP integration for Claude Code: Enables AI-assisted analysis via MCP, including querying and annotating cases.

Quick Start

Build THOR Lens locally, import an audit trail with thorlens import, and open the web UI to start exploring the timeline.

Frequently Asked Questions about thor-lens

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I visualize a THOR v11 audit trail in a forensic timeline?▼

To visualize a THOR v11 audit trail, import the JSONL logs into a browser-based interface to interactively explore event sequences, high-score detections, and case timelines.

Can I use THOR v10 audit trails with this forensic timeline viewer?▼

No, THOR v10 audit trails are not supported. The forensic timeline viewer strictly enforces the THOR v11 audit trail format and requires case-based Parquet events for compatibility.

Does the forensic timeline viewer support MCP integration for Claude Code?▼

Yes, the forensic timeline viewer supports MCP integration for Claude Code, enabling AI-assisted analysis by querying and annotating cases directly within the server-based web UI environment.

What is the best way to import JSONL logs for forensic case management?▼

The best way to import JSONL logs is using the thorlens import command, which ingests the audit trail and launches a server-based HTTP endpoint to explore the timeline in a web UI.

Do I need to install jq and numfmt to explore THOR audit trails?▼

Yes, you need jq and numfmt installed as dependencies to process and format the THOR audit trail data for the browser-based forensic timeline visualization.

Related Skills

Explore More Data & Analytics Skills→
NextronSystemsNextronSystems
12

thor-lens

Import THOR v11 audit trail JSONL files into an interactive forensic timeline UI.

Official
Intermediate
SherifEldeebSherifEldeeb
5

timeline-forensics

Aggregate disk, memory, log, PCAP, and registry artifacts into forensic timelines.

Community
Advanced
NextronSystemsNextronSystems
12

thor-scan

Generate safe, reproducible THOR scan commands for hosts, images, or memory dumps.

Official
Advanced
aresbitaresbit
46

session-logs

Search and analyze historical session JSONL files using jq and rg.

Community
Intermediate