thor-plugins

8

NextronSystems

Write, package, and use THOR plugins to extend scanner functionality. THOR v11+ only.

thor-troubleshooting

8

NextronSystems

Troubleshoot THOR runs that are stuck, slow, failing to start, stopping early, or produce missing output. Use when the user reports freezes, long runtimes, high CPU pauses, scan aborts, or licensing/update issues.

thor-lens

8

NextronSystems

THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10).

thor-scan

8

NextronSystems

Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.

custom-signatures

8

NextronSystems

Create and deploy custom IOCs, YARA rules, Sigma rules, and STIX indicators for THOR scans.

thor-log-analysis

8

NextronSystems

Interpret THOR scan results and explain what findings mean. Use when the user pastes THOR log lines, shares a log file, or asks how to triage Notices/Warnings/Alerts.

thor-db

8

NextronSystems

Analyze THOR's SQLite database (thor10.db/thor11.db) for performance tuning, scan timing, resume state, and delta comparisons. Use when investigating slow scans, debugging performance, or understanding what THOR tracked.