Threat Event Frequency is the upstream factor in a FAIR analysis. It estimates how often a particular threat actor type tries to do the thing that could cost you money. A privileged-user mistake might happen 50 times a year. A targeted phishing campaign might happen twice. A nation-state wiper attack might happen once every 50 years.
TEF is intentionally separated from whether the attempt succeeds. That separation is the difference between FAIR and a heatmap. A heatmap collapses "frequent attempts that almost always fail" into the same bucket as "rare attempts that almost always succeed", and the resulting risk score loses the information you need to decide whether to invest in prevention or in resilience.
Estimating TEF in a workshop is one of the parts the Risk Investigation Agent guides through directly. The worst answer is a precise point estimate. The right answer is a three-point estimate (minimum plausible, most likely, maximum plausible) drawn from people who handle the relevant systems. Industry threat intelligence reports help calibrate, but the estimate should reflect your environment, not a Verizon DBIR average.