You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Make the best use of the premium features for your needs in: **Scaling, Multi-tenancy, Enhanced proactive protection, Centralized management, Team collaboration, Integration and automation, Enhanced threat intelligence, and improved support.**
9
11
10
12
---
11
13
12
14
## Scaling, Automation & Multi-Tenancy
13
15
14
-
### Remediation Sync
15
-
Automatically synchronize security decisions across your entire organization. Syncs to all Security Engines and Blocklists Integration endpoints, ensuring consistent protection across your infrastructure.
16
-
[Learn more about remediation sync](/u/console/remediation_sync)
17
-
18
-
### Console Decision Management
19
-
Add, delete, and manage security decisions directly from the Console. Force pull blocklists when subscribing or unsubscribing, giving you complete control over your security posture from a central interface.
20
-
[Learn more about decision management](/u/console/decisions/decisions_management)
21
-
22
-
### Centralized Allowlists
23
-
Manage allowlists from a single location and apply them across all security engines and integrations organization-wide. Supports IP expiration for temporary allowlisting.
24
-
[Learn more about allowlists](/u/console/allowlists)
25
-
26
-
### Service API (SAPI)
27
-
Access APIs for console management.
28
-
[Learn more about Service API](/u/console/service_api/getting_started)
29
-
30
-
### Blocklist Creation & Sharing
31
-
Via our [Service API (SAPI)](/u/console/service_api/getting_started) Distribute custom blocklists across multiple organizations or partners, enabling coordinated security operations across your business ecosystem.
32
-
[Learn more about SAPI Blocklist endpoints](/u/console/service_api/blocklists)
33
-
34
-
### Auto Enroll
35
-
Automatically enroll new security engines into your organization for streamlined deployment and management.
36
-
37
-
### Expanded Organization Seats
38
-
Provide view/edit/admin access to you customers or collaborate with team members by adding more seats to your organization. (3 included in base Premium plan)
description="Automatically synchronize security decisions across your entire organization. Syncs to all Security Engines and Blocklists Integration endpoints, ensuring consistent protection across your infrastructure."
23
+
comparison={{
24
+
before: "Community: manual sync",
25
+
after: "Premium: automatic sync"
26
+
}}
27
+
link="/u/console/remediation_sync"
28
+
/>
29
+
30
+
<FeatureCard
31
+
title="Console Decision Management"
32
+
metric="Centralized"
33
+
category="scale"
34
+
description="Add, delete, and manage security decisions directly from the Console. Force pull blocklists when subscribing or unsubscribing, giving you complete control over your security posture from a central interface."
35
+
link="/u/console/decisions/decisions_management"
36
+
/>
37
+
38
+
<FeatureCard
39
+
title="Centralized Allowlists"
40
+
metric="Organization-wide"
41
+
category="scale"
42
+
description="Manage allowlists from a single location and apply them across all security engines and integrations organization-wide. Supports IP expiration for temporary allowlisting."
43
+
comparison={{
44
+
before: "Community: per-engine",
45
+
after: "Premium: centralized + expiration"
46
+
}}
47
+
link="/u/console/allowlists"
48
+
/>
49
+
50
+
<FeatureCard
51
+
title="Service API (SAPI)"
52
+
metric="REST + webhooks"
53
+
category="scale"
54
+
badges={["API"]}
55
+
description="Access APIs for console management. Automate blocklist creation, decision management, and enrollment operations via API."
56
+
comparison={{
57
+
before: "Community: no API access",
58
+
after: "Premium: full SAPI"
59
+
}}
60
+
link="/u/console/service_api/getting_started"
61
+
/>
62
+
63
+
<FeatureCard
64
+
title="Blocklist Creation & Sharing"
65
+
metric="Custom via API"
66
+
category="scale"
67
+
badges={["API"]}
68
+
description="Distribute custom blocklists across multiple organizations or partners, enabling coordinated security operations across your business ecosystem."
69
+
link="/u/console/service_api/blocklists"
70
+
/>
71
+
72
+
<FeatureCard
73
+
title="Auto Enroll"
74
+
metric="Zero-touch"
75
+
category="scale"
76
+
description="Automatically enroll new security engines into your organization for streamlined deployment and management. Perfect for infrastructure-as-code deployments."
77
+
comparison={{
78
+
before: "Community: manual enrollment",
79
+
after: "Premium: automatic enrollment"
80
+
}}
81
+
/>
82
+
83
+
<FeatureCard
84
+
title="Expanded Organization Seats"
85
+
metric="3 seats included"
86
+
category="scale"
87
+
description="Provide view/edit/admin access to your customers or collaborate with team members by adding more seats to your organization. Base Premium plan includes 3 seats, with options to add more."
88
+
comparison={{
89
+
before: "Community: 1 user only",
90
+
after: "Premium: full team (3+)"
91
+
}}
92
+
link="/u/console/organizations/intro"
93
+
/>
94
+
95
+
</div>
41
96
42
-
### Threat Forecast Blocklists
43
-
Access exclusive, organization-specific blocklists generated from the signals your organization shares with CrowdSec. These blocklists are more precise than community blocklists and provide tailored protection for your infrastructure.
44
-
[Learn more about threat forecast blocklists](/u/console/threat_forecast)
45
-
46
-
### Expanded Community Blocklist Coverage
47
-
Unlock the premium Community Blocklist as a network participant.
48
-
Receive up to 50k of the most aggressive attackers targeting similar services as yours *(up from top [3k in Community](/docs/central_api/community_blocklist/#community-blocklist-lite)).*
97
+
---
49
98
50
-
### Premium Tier Blocklist Access
51
-
Get access to our Premium tier blocklists, providing enhanced protection with curated specialized blocklists tailored for different attack vectors.
description="Access exclusive, organization-specific blocklists generated from the signals your organization shares with CrowdSec. These blocklists are more precise than community blocklists and provide tailored protection for your infrastructure."
108
+
comparison={{
109
+
before: "Community: generic list",
110
+
after: "Premium: org-specific"
111
+
}}
112
+
link="/u/console/threat_forecast"
113
+
/>
114
+
115
+
<FeatureCard
116
+
title="Expanded Community Blocklist Coverage"
117
+
metric="3k → 50k IPs"
118
+
category="protection"
119
+
description="Unlock the premium Community Blocklist as a network participant. Receive up to 50,000 of the most aggressive attackers targeting similar services as yours (up from top 3k in Community)."
120
+
comparison={{
121
+
before: "Community: top 3k",
122
+
after: "Premium: top 50k (×16)"
123
+
}}
124
+
link="/u/console/blocklists/intro"
125
+
/>
126
+
127
+
<FeatureCard
128
+
title="Premium Tier Blocklist Access"
129
+
metric="Curated lists"
130
+
category="protection"
131
+
description="Get access to our Premium tier blocklists, providing enhanced protection with curated specialized blocklists tailored for different attack vectors."
description="Premium subscribers get unlimited blocklist subscriptions (compared to 3 in Community), allowing you to protect your infrastructure with multiple specialized blocklists simultaneously."
Premium subscribers get unlimited blocklist subscriptions (compared to 3 in Community), allowing you to protect your infrastructure with multiple specialized blocklists simultaneously.
55
-
[Learn more about premium tier blocklists features](/u/blocklists/intro#crowdsec-blocklist-tiers)
149
+
---
56
150
57
151
## Reactivity & Monitoring
58
152
59
-
### Am I Under Attack Feature
60
-
Receive real-time alerts when your infrastructure experiences attack surges. This feature analyzes current traffic patterns against historical baselines to detect anomalous activity, with support for email notifications and webhook integrations.
61
-
[Learn more about attack detection](/u/console/security_engines/am_i_under_attack)
62
-
63
-
### Push Notifications Integrations
64
-
Receive alerts when security engines go offline or become outdated, ensuring your security infrastructure remains operational.
65
-
[Learn more about push notifications](/u/console/notification_integrations/overview)
66
-
67
-
### Increased Alert Quotas and Extended Retention
68
-
Upgrade from the Community Plan's 500 alerts per month and 2-month retention to custom quotas (up to several million alerts) and up to 1 year of retention. This enables comprehensive monitoring of large-scale infrastructures and long-term security analysis.
69
-
[Learn more about premium quotas](/u/console/alerts/quotas#why-upgrade-to-premium-)
70
-
71
-
### Background Noise Filtering
72
-
Automatically filter out internet background radiation and mass scanning activity to focus on genuine threats. Customize noise cancellation levels (Low, Medium, High) to match your security requirements.
73
-
[Learn more about background noise filtering](/u/console/alerts/background_noise)
74
-
75
-
### IP reputation investigation quotas
76
-
Audit what CrowdSec knows about IP addresses, attacking you and present in blocklists, with increased investigation quotas.
77
-
100 attacker details per week (compared to 30 in Community), including IP reputation and MITRE ATT&CK mappings for comprehensive threat intelligence.
78
-
79
-
### CTI API Access
80
-
Leverage CrowdSec IP reputation data into your vendors.
81
-
Get 100 CTI API calls per week (compared to 30 in Community) for integration with SIEM, SOAR, and other security tools.
82
-
[Learn more about CTI API](/u/cti_api/api_integration/integration_intro)
description="Receive real-time alerts when your infrastructure experiences attack surges. This feature analyzes current traffic patterns against historical baselines to detect anomalous activity, with support for email notifications and webhook integrations."
description="Receive alerts when security engines go offline or become outdated, ensuring your security infrastructure remains operational. Native integrations with major SecOps tools."
title="Increased Alert Quotas and Extended Retention"
177
+
metric="2 months → 1 year"
178
+
category="monitoring"
179
+
description="Upgrade from the Community Plan's 500 alerts per month and 2-month retention to custom quotas (up to several million alerts) and up to 1 year of retention. This enables comprehensive monitoring of large-scale infrastructures and long-term security analysis."
description="Automatically filter out internet background radiation and mass scanning activity to focus on genuine threats. Customize noise cancellation levels (Low, Medium, High) to match your security requirements."
192
+
comparison={{
193
+
before: "Community: all signals",
194
+
after: "Premium: real threats only"
195
+
}}
196
+
link="/u/console/alerts/background_noise"
197
+
/>
198
+
199
+
<FeatureCard
200
+
title="IP Reputation Investigation"
201
+
metric="30 → 100/week"
202
+
category="intelligence"
203
+
description="Audit what CrowdSec knows about IP addresses attacking you and present in blocklists, with increased investigation quotas. 100 attacker details per week (compared to 30 in Community), including IP reputation and MITRE ATT&CK mappings for comprehensive threat intelligence."
204
+
comparison={{
205
+
before: "Community: 30 lookups/week",
206
+
after: "Premium: 100 lookups/week"
207
+
}}
208
+
/>
209
+
210
+
<FeatureCard
211
+
title="CTI API Access"
212
+
metric="30 → 100 calls/week"
213
+
category="intelligence"
214
+
badges={["API"]}
215
+
description="Leverage CrowdSec IP reputation data into your vendors. Get 100 CTI API calls per week (compared to 30 in Community) for integration with SIEM, SOAR, and other security tools."
0 commit comments