TPFP TI study plan
TPFP TI · Give each week a clear focus.
8 weeks · About 6 hours per week
Threat Intelligence Fundamentals
Define the intelligence cycle's six stages and write a one-paragraph description of each stage from memory.
Distinguish tactical, operational, and strategic intelligence and classify ten example products you invent into the correct tier.
Differentiate data, information, intelligence, and knowledge, then map each term onto a stage of the intelligence cycle.
List the five intelligence requirements categories (strategic, priority, etc.) and draft one requirement statement for a fictional organization.
Explain how the 'intelligence gap' concept drives collection planning and produce a short gap list for a sample scenario.
Your checkpoint
A one-page intelligence cycle diagram plus a glossary of 15 domain terms with your own definitions and one example each.
Threat Intelligence Fundamentals & Threat Intelligence Analysis and Production
Compare the main analytic frameworks (kill chain, MITRE ATT&CK, diamond model, F3EAD) and state when each is most useful.
Apply the diamond model to a publicly described intrusion and label all four vertices with evidence.
Explain the difference between indicators of compromise and indicators of attack and give three examples of each.
Identify at least five cognitive biases (confirmation, anchoring, availability, etc.) and describe a mitigation for each.
Draft a structured analytic technique (ACH or key assumptions check) applied to a simple hypothesis.
Your checkpoint
A two- to three-page analytic note that applies the diamond model and one structured technique to a fictional intrusion, including an explicit confidence statement.
Threat Data Collection and Sources
Enumerate at least eight collection source categories (OSINT, commercial feeds, ISACs, honeypots, malware sandboxes, DNS/WHOIS, dark web, government advisories) and note strengths and limits of each.
Evaluate three open-source feeds against criteria such as timeliness, fidelity, and false-positive rate.
Explain the Traffic Light Protocol (TLP) 2.0 color scheme and tag five example artifacts correctly.
Describe the collection management process, including PIRs and source prioritization, and draft a small collection plan.
Identify legal and ethical constraints on collection (scraping, ToS, privacy) and document three rules you would follow.
Your checkpoint
A source evaluation matrix covering at least eight sources with scored criteria and a short written recommendation of which three you would prioritize.
Threat Intelligence Analysis and Production
Produce finished intelligence in at least two formats (a short tactical report and a strategic brief) using a standard structure.
Write intelligence requirements and a PIR set for a fictional organization, then trace how each is satisfied.
Apply the Analysis of Competing Hypotheses method to a scenario with at least three hypotheses and score the evidence.
Calibrate confidence language (possible, likely, almost certain) and use it consistently across two products.
Build an indicator enrichment workflow that adds context such as infrastructure, malware family, and campaign attribution.
Your checkpoint
A finished intelligence product of 800-1,200 words with an executive summary, key judgments, confidence levels, and an indicator appendix.
Threat Intelligence Dissemination and Sharing & Operational Security and Legal/Ethical Considerations
Explain the purpose and structure of sharing communities (ISACs, ISAOs, CERTs) and the role of standards such as STIX/TAXII and MISP.
Map the dissemination process: who needs what, in what format, and on what timeline, and draft a dissemination matrix.
Describe TLP handling rules and apply them to three sharing scenarios, including onward-sharing restrictions.
Summarize legal considerations (data protection, GDPR-style rules, handling of PII, contractual limits) and ethical duties of analysts.
Explain operational security practices for analysts: attribution risks, infrastructure separation, and safe handling of malware.
Your checkpoint
A dissemination and sharing policy one-pager covering audiences, formats, TLP rules, and legal/ethical guardrails, plus a completed TLP tagging exercise.
Threat Intelligence Tools and Platforms
Compare at least five platform categories (TIPs, SIEM, SOAR, malware sandboxes, OSINT tooling) and state the core function of each.
Describe how STIX/TAXII and MISP support automated indicator exchange and outline a basic sharing workflow.
Set up or simulate a small indicator store and demonstrate enrichment and deduplication of at least 20 indicators.
Evaluate a threat intelligence platform against criteria such as integration, scoring, and workflow, and write a short comparison.
Explain how automation and scoring (e.g., confidence and aging) reduce alert fatigue.
Your checkpoint
A tool comparison table for five platforms plus a documented workflow showing 20 indicators collected, enriched, deduplicated, and scored.
Threat Intelligence in Incident Response and Hunting
Map the intelligence cycle onto the incident response lifecycle and identify where threat intel adds value at each phase.
Write at least five hypothesis-driven hunting queries or logic statements based on ATT&CK techniques.
Explain how indicators and TTPs support detection engineering, and translate one intel report into a detection rule concept.
Describe the role of threat intel in triage, scoping, and containment during an incident.
Document a feedback loop from hunting and IR findings back into collection requirements.
Your checkpoint
A threat hunting playbook for one ATT&CK technique: hypothesis, data sources, query logic, expected evidence, and feedback steps.
Threat Intelligence Fundamentals & Threat Intelligence Analysis and Production & Threat Intelligence Dissemination and Sharing & Operational Security and Legal/Ethical Considerations & Threat Intelligence Tools and Platforms & Threat Intelligence in Incident Response and Hunting
Consolidate weak areas by re-testing each domain with practice questions and logging missed concepts.
Produce a full mock intelligence cycle end-to-end: requirements, collection, analysis, product, and dissemination, in one scenario.
Review all deliverables and update the glossary and key frameworks.
Practice explaining five core concepts aloud in under two minutes each.
Build a one-page exam-day reference sheet of frameworks, TLP rules, and confidence terms.
Your checkpoint
A complete end-to-end mock intelligence package (requirements, collection plan, analytic product, dissemination note) plus a scored self-assessment across all seven domains.
Milestones
Week 2: Can define the intelligence cycle stages and correctly apply the diamond model without notes.
Week 4: Score at least 70% on a self-made 25-question quiz covering domains 1-3, and have produced one finished intelligence product.
Week 6: Can explain TLP rules, sharing standards, and platform categories, and have a working indicator workflow documented.
Week 8: Complete the end-to-end mock package and score at least 80% on a full-length practice set across all domains.