TPFP TI case studies
TPFP TI · Put your knowledge to work in context.
The TPFP TI (Threat Intelligence) certification is a professional credential aimed at practitioners who gather, analyse, and act on cyber threat intelligence. It suits SOC analysts, CTI analysts, incident responders, threat hunters, and security engineers moving from raw data handling into structured intelligence production. The TPFP TI case studies are 5 cases and about 3,572 words.
1The 98% Coverage Feed and a Three-Person Team
A 1,200-bed hospital group runs a three-person cyber threat intelligence (CTI) team supporting a 14,000-endpoint estate. The CISO is evaluating a commercial feed priced at USD 120,000 per year.
765 words, about 4 min2Paste-Site Card Dump and a 20-Hour Collection Budget
A card issuer with 2.1 million cardholders has a five-person fraud and cyber team. During a phishing wave, an analyst finds a public paste-site post containing 4,800 card numbers and a note claiming 'fresh dump, 70% live'.
726 words, about 4 min3One Hash, a FIN7 Claim, and a Customer Notification Deadline
A Tier-1 automotive supplier runs 900 servers and a segmented OT network. EDR shows a Cobalt Strike beacon on an engineering workstation, and the SIEM sees SMB password spraying from a developer VLAN.
708 words, about 4 min4TLP:AMBER, a Non-Member Partner, and a Journalist's Question
A regional bank is a member of a sector ISAC. It receives a report marked TLP:AMBER containing 37 IP addresses and 12 domains tied to a phishing kit that targets online banking.
716 words, about 4 min5A Suspicious Scheduled Task Before Peak Season
A national retailer with 6,000 endpoints across 400 stores has EDR and a SIEM, but only 30 days of EDR retention and no network flow data from stores. An alert shows a scheduled task named 'GoogleUpdateTaskMachineUA' created on a point-of-sale server by cmd.exe running an encoded PowerShell command.
657 words, about 3 min