TPFP TI study guide

TPFP TI · Work through your exam, one topic at a time.

The TPFP TI (Threat Intelligence) certification is a professional credential aimed at practitioners who gather, analyse, and act on cyber threat intelligence. It suits SOC analysts, CTI analysts, incident responders, threat hunters, and security engineers moving from raw data handling into structured intelligence production. The TPFP TI study guide has 7 sections and about 3,244 words.

Threat Intelligence Fundamentals

This domain tests whether you can separate raw data from finished intelligence, place an activity at the right intelligence level, and defend a judgement with a stated confidence. Expect scenario questions - scraping a paste site, briefing a CISO, writing a YARA rule - that ask which level or lifecycle phase is involved.

483 words, about 2 min 02

Threat Data Collection and Sources

This domain tests whether you can plan collection against a requirement, grade a source's reliability separately from its content, and choose a source class that is both appropriate and lawful for the question asked. OSINT: public web, news, company registries, certificate transparency, WHOIS and passive DNS.

460 words, about 2 min 03

Threat Intelligence Analysis and Production

This domain tests whether you can turn collected material into a defensible judgement: structured, sourced, confidence-rated, and written for a named audience. Lead with the bottom line (BLUF), then key judgements, then evidence and analytic rationale, then confidence and gaps.

403 words, about 2 min 04

Threat Intelligence Dissemination and Sharing

This domain tests whether you can get the right product to the right audience with the right handling restrictions, in a format the consumer can act on - and whether you know the sharing standards well enough to choose between them. A SOC needs machine-readable indicators and detection logic; a CISO needs a one-page judgement with business impact; a peer CERT needs attributed observables.

464 words, about 2 min 05

Operational Security and Legal/Ethical Considerations

This domain tests the boundary work: what an analyst may lawfully and ethically do while collecting and acting on threat intelligence, and how to avoid becoming part of the story. Every collection activity needs a defined scope: targets, methods, time window, escalation path, and approving authority.

456 words, about 2 min 06

Threat Intelligence Tools and Platforms

This domain tests practical workflow: which platform owns which function, how to pivot from an atomic indicator to behaviour, and where automation quietly degrades quality. TIP (MISP, OpenCTI): store, normalise, correlate, and share intelligence; feeds in, products out.

477 words, about 2 min 07

Threat Intelligence in Incident Response and Hunting

This domain tests whether you can use intelligence to shorten an intrusion, and whether you can distinguish real hunting from an indicator sweep with a marketing name. Preparation: actor playbooks, sector-relevant TTPs, and detection coverage mapped to ATT&CK.

501 words, about 3 min