THRIVE: A Structured, CTI-Prioritised Threat Hunting Methodology for Security Operations Centres (SOCs)

Pandhare, Amruta Anant (2025) THRIVE: A Structured, CTI-Prioritised Threat Hunting Methodology for Security Operations Centres (SOCs). Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (2MB) | Preview
Preview	PDF (Configuration Manual) Download (8MB) | Preview

Abstract

Proactive threat hunting remains essential for identifying sophisticated adversaries and minimizing detection gaps. While existing frameworks such as Sqrrl’s Hunting Maturity Model, TaHiTI, and PEAK offer structured approaches, they encounter limitations in scalability, intelligence integration, and measurable assessment. This thesis introduces THRIVE; a nine-phase methodology aimed at operationalizing cyber threat intelligence (CTI) and standardizing detection engineering within Security Operations centres (SOCs). THRIVE incorporates a CTI scoring model, hypothesis development aligned with MITRE ATT&CK techniques, collaborative peer review, validation through red-blue team simulations, and the transformation of hunts into automated detections. Dashboards enhance visibility into coverage, validated detections, and resolved visibility gaps. Developed using the Design Science Research Methodology (DSRM), THRIVE was applied during a 12-week SOC internship and evaluated through case studies. Evaluation highlights THRIVE’s ability to translate CTI into validated detection rules, enforce accountability through peer review, and provide metrics for leadership. Comparative analysis confirms its originality in combining intelligence-led prioritization with measurable operational outcomes, advancing the maturity of SOC hunting.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Mahajan, Kamil UNSPECIFIED
Uncontrolled Keywords:	Threat Hunting; Cyber Threat Intelligence; Security Operation Centres; MITRE ATT&CK; Security Information; Event Management (SIEM)
Subjects:	Q Science > QA Mathematics > Electronic computers. Computer science T Technology > T Technology (General) > Information Technology > Electronic computers. Computer science Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Cyber Security
Depositing User:	Ciara O'Brien
Date Deposited:	04 Jul 2026 14:24
Last Modified:	04 Jul 2026 14:24
URI:	https://norma.ncirl.ie/id/eprint/9477

Actions (login required)

View Item