Skip to content

Commit 328ff74

Browse files
author
jdv
committed
updated testing premium page
1 parent d1644a4 commit 328ff74

File tree

1 file changed

+257
-34
lines changed

1 file changed

+257
-34
lines changed

‎crowdsec-docs/unversioned/console/premium_upgrade/testing_premium.mdx‎

Lines changed: 257 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -4,54 +4,277 @@ title: Test Premium Value in Your Environment
44
description: Practical ways to measure and experience Premium value during your trial
55
---
66

7-
Before exploring all Premium features, here are practical ways to measure and experience the value yourself.
8-
The following can be used as a guide during your trial period to assess the benefits of upgrading to Premium.
7+
import { FeatureCard, HighlightCard } from '@site/src/components/premium-upgrade/feature-card';
98

10-
## 🎯 Measure Improved Protection
9+
<div className="p-6 rounded-xl bg-gradient-to-r from-primary/10 to-primary/5 border border-solid border-primary/20 mb-8">
1110

12-
**Activate:**
13-
- Community Blocklists (premium) will automatically be sent to your enrolled engines.
14-
- The [Threat Forecast Blocklist](/u/console/threat_forecast) Will be generated automatically used in your organization based on your shared signals.
15-
- Premium Tier Blocklists can be subscribed and subscription numbers per org are unlimited.
16-
- You can activate [Remediation Sync](/u/console/remediation_sync) to propagate decisions across all your enrolled Security Engines.
17-
- Respond faster to a spike of alerts thanks to "Am I Under Attack"
11+
## 🧪 Measure Premium Value During Your Trial
1812

19-
**Measure the impact:**
20-
- **Remediation Metrics:** Track your proactive vs reactive blocking ratio
21-
- **Server Resources:** Monitor CPU, memory, and bandwidth reduction
22-
- **SIEM Logs:** Measure log volume decrease and background noise reduction
13+
Before exploring all Premium features, use this guide to measure and experience the value in your environment. These practical tests help you assess the concrete benefits of Premium during your trial period.
2314

24-
**Expected results:** 2x more proactive blocking, 75-92% less malicious traffic reaching your servers, cleaner logs and reduced alert fatigue.
15+
</div>
2516

2617
---
2718

28-
## 👥 Enable Team Collaboration
19+
## 🎯 Test 1: Measure Improved Protection
2920

30-
**Activate:**
31-
- Invite collaborators thanks to Multi-Seat Access
32-
- Extended Alert Retention (365 days) allow improved traceability
33-
- Use the improved in-console CTI quotas to enrich your investigations
34-
- Get notified within your tools thanks to [Push Notification Integrations](/u/console/notification_integrations/overview)
21+
<div className="border-l-4 border-solid border-primary p-6 bg-card mb-6">
3522

36-
**How your team benefits:**
37-
- Analyze long-term attack trends and recurring threats
38-
- Conduct CTI investigations directly in the Console
39-
- Multiple team members work simultaneously without access conflicts
23+
### What to Activate
4024

41-
**Expected results:** Faster incident investigations, better threat attribution, reduced tool sprawl.
25+
Premium protection features are automatically enabled when you upgrade:
26+
27+
- **Community Blocklist (Premium):** Automatically sent to enrolled engines (50k IPs vs 3k)
28+
- **[Threat Forecast Blocklist](/u/console/threat_forecast):** Generated automatically from your organization's shared signals
29+
- **Premium Tier Blocklists:** Subscribe to unlimited specialized blocklists
30+
- **[Remediation Sync](/u/console/remediation_sync):** Propagate decisions across all Security Engines
31+
- **Am I Under Attack:** Get alerted on traffic surges
32+
33+
</div>
34+
35+
<div className="grid grid-cols-1 md:grid-cols-3 gap-4 mb-8">
36+
37+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
38+
39+
### 📊 Metric 1: Remediation Ratio
40+
41+
**How to measure:**
42+
Check your Console dashboard for proactive vs reactive blocking ratio.
43+
44+
**Expected result:**
45+
2× more proactive blocking (blocklist hits vs real-time decisions)
46+
47+
</div>
48+
49+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
50+
51+
### 💻 Metric 2: Server Resources
52+
53+
**How to measure:**
54+
Monitor CPU, memory, and bandwidth usage on your Security Engines before and after.
55+
56+
**Expected result:**
57+
75-92% reduction in malicious traffic reaching your servers
58+
59+
</div>
60+
61+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
62+
63+
### 📝 Metric 3: Log Volume
64+
65+
**How to measure:**
66+
Check your SIEM or log aggregator for alert volume changes.
67+
68+
**Expected result:**
69+
Cleaner logs, reduced alert fatigue, fewer false positives
70+
71+
</div>
72+
73+
</div>
74+
75+
<HighlightCard
76+
title="Quick Test: Background Noise Filtering"
77+
category="monitoring"
78+
description="Enable Background Noise Filtering (Low/Medium/High) and compare your alert dashboard before/after. You should see 75-92% fewer scanner and crawler alerts within 24 hours."
79+
stats={[
80+
{ value: "24h", label: "to see results" },
81+
{ value: "75-92%", label: "noise reduction" }
82+
]}
83+
link="/u/console/alerts/background_noise"
84+
/>
85+
86+
---
87+
88+
## 👥 Test 2: Enable Team Collaboration
89+
90+
<div className="border-l-4 border-solid border-primary p-6 bg-card mb-6">
91+
92+
### What to Activate
93+
94+
Enable team features to see collaboration improvements:
95+
96+
- **Multi-Seat Access:** Invite team members (view/edit/admin roles)
97+
- **Extended Alert Retention:** 365 days of historical data (vs 60 days)
98+
- **Increased CTI Quotas:** 100 IP lookups/week (vs 30)
99+
- **[Push Notification Integrations](/u/console/notification_integrations/overview):** Slack, PagerDuty, webhooks
100+
101+
</div>
102+
103+
<div className="grid grid-cols-1 md:grid-cols-2 gap-4 mb-6">
104+
105+
<FeatureCard
106+
title="Test: Long-Term Trend Analysis"
107+
metric="365 days"
108+
category="monitoring"
109+
description="Access your Console's Alerts page and analyze attack patterns over the past year. Look for recurring threats, seasonal patterns, or evolving attack vectors. This is impossible with Community's 60-day retention."
110+
link="/u/console/alerts/quotas#why-upgrade-to-premium-"
111+
/>
112+
113+
<FeatureCard
114+
title="Test: CTI Investigation Workflow"
115+
metric="100 lookups/week"
116+
category="intelligence"
117+
description="Investigate suspicious IPs directly in the Console. View complete profiles: reputation, behavior, fingerprint, MITRE ATT&CK mappings. Perfect for incident response workflows without leaving the Console."
118+
/>
119+
120+
<FeatureCard
121+
title="Test: Simultaneous Access"
122+
metric="3+ seats"
123+
category="scale"
124+
description="Have multiple team members work in the Console at the same time. Test concurrent operations: one person investigates alerts, another manages allowlists, a third reviews metrics. No access conflicts."
125+
link="/u/console/organizations/intro"
126+
/>
127+
128+
<FeatureCard
129+
title="Test: Alerting Integration"
130+
metric="Real-time"
131+
category="monitoring"
132+
description="Connect your Slack or PagerDuty account and test notifications when a Security Engine goes offline or becomes outdated. Verify your team receives alerts in their existing tools."
133+
link="/u/console/notification_integrations/overview"
134+
/>
135+
136+
</div>
137+
138+
<div className="p-6 rounded-lg bg-gray-50 dark:bg-gray-900/30 border border-solid border-border mb-8">
139+
140+
**Expected Results:**
141+
142+
- ⚡ Faster incident investigations (direct CTI access in Console)
143+
- 🔍 Better threat attribution (1-year retention for pattern analysis)
144+
- 🤝 Reduced tool sprawl (team works in one place)
145+
- 📢 Proactive alerting (issues detected before users complain)
146+
147+
</div>
148+
149+
---
150+
151+
## 🏢 Test 3: Scale for MSPs & Enterprises
152+
153+
<div className="border-l-4 border-solid border-primary p-6 bg-card mb-6">
154+
155+
### What to Activate
156+
157+
Test multi-tenant and automation capabilities:
158+
159+
- **Multi-Organization:** Create separate organizations for each client/environment
160+
- **[Service API (SAPI)](/u/console/service_api/getting_started):** Automate console management
161+
- **Blocklist Creation & Sharing:** Distribute custom threat intel via API
162+
- **Auto Enroll:** Zero-touch engine enrollment
163+
164+
</div>
165+
166+
<div className="grid grid-cols-1 md:grid-cols-2 gap-4 mb-6">
167+
168+
<FeatureCard
169+
title="Test: Multi-Tenant Isolation"
170+
metric="100% isolated"
171+
category="scale"
172+
description="Create 2-3 test organizations for different clients. Verify complete data isolation: each org sees only its engines, alerts, and decisions. Test switching between orgs from a single account."
173+
/>
174+
175+
<FeatureCard
176+
title="Test: Custom Blocklist via API"
177+
metric="API-driven"
178+
category="scale"
179+
badges={["API"]}
180+
description="Use SAPI to create a custom blocklist with 10-20 IPs from your SIEM. Subscribe multiple organizations to it. Verify the IPs are blocked across all client environments within minutes."
181+
link="/u/console/service_api/blocklists"
182+
/>
183+
184+
<FeatureCard
185+
title="Test: Automated Enrollment"
186+
metric="Zero-touch"
187+
category="scale"
188+
description="Enable Auto Enroll, then deploy a new Security Engine with your org's enrollment key. It should automatically join your organization without manual approval. Perfect for Terraform/Ansible/K8s deployments."
189+
/>
190+
191+
<FeatureCard
192+
title="Test: Decision Management via API"
193+
metric="Programmatic"
194+
category="scale"
195+
badges={["API"]}
196+
description="Use SAPI to add/remove decisions from the Console. Test forcing a blocklist pull after subscription. Integrate this into your incident response playbooks or SOAR platform."
197+
link="/u/console/service_api/getting_started"
198+
/>
199+
200+
</div>
201+
202+
<div className="p-6 rounded-lg bg-gray-50 dark:bg-gray-900/30 border border-solid border-border mb-8">
203+
204+
**Expected Results:**
205+
206+
- 🏗️ Clear tenant isolation (one org per client)
207+
- 🤖 Streamlined multi-customer operations (API automation)
208+
- 📊 Custom visibility per client (each org has its own dashboard)
209+
- ⚙️ Infrastructure-as-code ready (zero-touch enrollment)
210+
211+
</div>
42212

43213
---
44214

45-
## 🏢 Scale for MSPs & Enterprises
215+
## 🎓 Recommended Trial Timeline
216+
217+
<div className="grid grid-cols-1 md:grid-cols-4 gap-4 mb-8 text-sm">
218+
219+
<div className="border-2 border-solid border-primary/30 rounded-lg p-6 bg-card">
220+
221+
### Week 1: Protection
222+
223+
- Enable all blocklists
224+
- Activate Background Noise
225+
- Turn on Remediation Sync
226+
- Measure baseline metrics
227+
228+
</div>
229+
230+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
231+
232+
### Week 2: Team
233+
234+
- Invite team members
235+
- Test CTI lookups
236+
- Configure push notifications
237+
- Analyze historical trends
238+
239+
</div>
240+
241+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
242+
243+
### Week 3: Scale
244+
245+
- Create test organizations
246+
- Test SAPI endpoints
247+
- Try Auto Enroll
248+
- Custom blocklist sharing
249+
250+
</div>
251+
252+
<div className="border border-solid border-border rounded-lg p-6 bg-card">
253+
254+
### Week 4: Review
255+
256+
- Compare metrics vs Week 1
257+
- Document value realized
258+
- Plan production rollout
259+
- Prepare upgrade decision
260+
261+
</div>
262+
263+
</div>
264+
265+
---
266+
267+
## 💡 Need Help Testing?
268+
269+
<div className="p-6 rounded-xl bg-gradient-to-r from-primary/10 to-primary/5 border border-solid border-primary/20">
46270

47-
**Activate:**
48-
- Administrate & share access to your clients thanks to Multi-Organization
49-
- Create & Share Blocklists across organizations via our [Service API (SAPI)](/u/console/service_api/getting_started)
271+
### Questions about your trial?
50272

273+
Our team can help you set up proper testing and measure the value in your specific environment.
51274

52-
**Manage at scale:**
53-
- Segment customer environments (one org per client)
54-
- Share custom threat intelligence across organizations
55-
- Automate blocklist management via API
275+
<div style={{display: 'flex', gap: '1rem', marginTop: '1.5rem', flexWrap: 'wrap'}}>
276+
<a href="https://www.crowdsec.net/contact-crowdsec" className="button button--primary button--lg">Contact Support</a>
277+
<a href="/u/console/premium_upgrade/features_overview" className="button button--secondary button--lg">View All Features →</a>
278+
</div>
56279

57-
**Expected results:** Clear tenant isolation, streamlined multi-customer operations, custom visibility on their defenses.
280+
</div>

0 commit comments

Comments
 (0)