# cisagov/thorium

A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale.

Repository: https://github.com/cisagov/thorium
Canonical: https://ross.abutalabs.com/products/cisagov-thorium
Homepage: https://cisagov.github.io/thorium/
Language: Rust
License: NOASSERTION
License Family: other
Topics: docker, kubernetes, malware-analysis, rust, rust-lang, scalability
Last push: 2026-07-07T23:34:11+00:00

## Health v2 (maintenance only)
Score: 74/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 91, release rhythm 73, longevity 36
- inputs: {"age_days": 504, "days_push": 57, "days_rel": 181, "gap_med": 9.0, "n_releases_24m": 9}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1022, forks 121 (observed 2026-08-28T04:03:16.036184+00:00)

## What it is
Thorium is a scalable, distributed file analysis and data generation platform that orchestrates arbitrary Docker, VM, or shell-based tools at scale, primarily aimed at malware analysis and cyber incident response. It provides sandboxed static and dynamic analysis, full-text search of results, tagging, and multi-tenant sharing via GUI, CLI, and RESTful API.

## Use cases
- analyze malware samples at scale with docker-based tools
- orchestrate file analysis pipelines across a kubernetes cluster
- triage files during cyber incident response
- search and share analysis results across an analyst team
- run reverse engineering tools like capa and floss on uploaded binaries
- store and tag billions of samples with metadata

## When to choose
- you need to run many analysis tools over large volumes of files in a scalable, multi-tenant way
- you want sandboxed static and dynamic malware analysis with encrypted file storage (CaRT)
- you need a REST API, CLI, and GUI over a shared file analysis repository

## When to avoid
- you only need a simple single-machine scanner - the production deployment requires a Kubernetes cluster, block store, and S3 storage
- you need a lightweight pipeline runner without the analysis/search/sharing platform overhead
- single-node Minithor deployments are not intended for production use

## Facets
- artifact type: application
- maturity: active
- function: workflow-automation, container-orchestration, search-engine, security, api-framework, cli, gui, file-upload, analytics
- domain: security, developer-tools, self-hosted, microservices
- platform: rust, self-hosted, cloud
- tags: malware-analysis, file-analysis, incident-response, sandboxing, multi-tenant, data-generation, reverse-engineering-tools, automation, kubernetes, docker, linux

## Member repositories
- cisagov/thorium (main) score 74

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:16.036184+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:08:42.651863+00:00, confidence not recorded.
  - readme: https://github.com/cisagov/thorium (fetched 2026-08-28T04:03:16.036184+00:00, sha 0df015d57921)
  - homepage: https://cisagov.github.io/thorium/ (fetched 2026-08-29T13:08:50.020632+00:00, sha f8874bb5ad53)
- Data as of 2026-08-30T08:39:29.467469+00:00.