THOR Lens workflows for forensic timeline analysis. A web UI that imports THOR v11 audit trail JSONL logs for interactive exploration. Requires THOR v11 (audit trail not available in v10).
THOR Lens is a forensic timeline viewer that transforms THOR v11 audit trail files into an interactive exploration interface.
Critical Boundary:
# 1. Clone and build
git clone https://github.com/NextronSystems/thor-lens.git
cd thor-lens
make build
# 2. Import an audit trail
./thorlens import --log /path/to/audit.jsonl --case mycase
# 3. Serve and open browser
./thorlens serve --case ./cases/mycase --port 8080
# Open http://127.0.0.1:8080
| Item | Value |
|------|-------|
| Upstream repo | https://github.com/NextronSystems/thor-lens |
| Default port | 8080 |
| Case storage | ./cases/<name>/ |
| Input format | JSONL (.jsonl or .jsonl.gz) |
| MCP stdio | ./thorlens serve --case <path> --mcp-stdio |
| MCP HTTP | http://localhost:8080/mcp (default) |
--virtual-map and -j during THOR scans to preserve path/hostname contextEdit PDFs with natural-language instructions using the nano-pdf CLI.
Control Sonos speakers (discover/status/play/volume/group).
Terminal Spotify playback/search via spogo (preferred) or spotify_player.
Capture frames or clips from RTSP/ONVIF cameras.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
Category:tools