cisagov/thorium

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1022 stars · 121 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Thorium is a scalable, distributed file analysis and data generation platform that orchestrates arbitrary Docker, VM, or shell-based tools at scale, primarily aimed at malware analysis and cyber incident response. It provides sandboxed static and dynamic analysis, full-text search of results, tagging, and multi-tenant sharing via GUI, CLI, and RESTful API.

Use cases

• analyze malware samples at scale with docker-based tools
• orchestrate file analysis pipelines across a kubernetes cluster
• triage files during cyber incident response
• search and share analysis results across an analyst team
• run reverse engineering tools like capa and floss on uploaded binaries
• store and tag billions of samples with metadata

When to choose

• you need to run many analysis tools over large volumes of files in a scalable, multi-tenant way
• you want sandboxed static and dynamic malware analysis with encrypted file storage (CaRT)
• you need a REST API, CLI, and GUI over a shared file analysis repository

When to avoid

• you only need a simple single-machine scanner - the production deployment requires a Kubernetes cluster, block store, and S3 storage
• you need a lightweight pipeline runner without the analysis/search/sharing platform overhead
• single-node Minithor deployments are not intended for production use

Facets

application · maturity active

workflow-automation container-orchestration search-engine security api-framework cli gui file-upload analytics security developer-tools self-hosted microservices rust self-hosted cloud malware-analysis file-analysis incident-response sandboxing multi-tenant data-generation reverse-engineering-tools automation kubernetes docker linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cisagov/thorium")