Skip to main content

Premium Features Overview

Premium features enable multiple use cases. Make the best use of the premium features for your needs in: Scaling, Multi-tenancy, Inhanced proactive protection, Centralized management, Team collaboration, Integration and automation, Enhanced threat intelligence, and improved support.

Scaling, Automation & Multi-Tenancy​

Remediation Sync​

Automatically synchronize security decisions across your entire organization. Syncs to all Security Engines and Blocklists Integration endpoints, ensuring consistent protection across your infrastructure. Learn more about remediation sync

Console Decision Management​

Add, delete, and manage security decisions directly from the Console. Force pull blocklists when subscribing or unsubscribing, giving you complete control over your security posture from a central interface. Learn more about decision management

Centralized Allowlists​

Manage allowlists from a single location and apply them across all security engines and integrations organization-wide. Supports IP expiration for temporary allowlisting. Learn more about allowlists

Service API (SAPI)​

Access APIs for console management. Learn more about Service API

Blocklist Creation & Sharing​

Via our Service API (SAPI) Distribute custom blocklists across multiple organizations or partners, enabling coordinated security operations across your business ecosystem. Learn more about SAPI Blocklist endpoints

Auto Enroll​

Automatically enroll new security engines into your organization for streamlined deployment and management.

Expanded Organization Seats​

Provide view/edit/admin access to you customers or collaborate with team members by adding more seats to your organization. (3 included in bas Premium plan)

Extra protection​

Threat Forecast Blocklists​

Access exclusive, organization-specific blocklists generated from the signals your organization shares with CrowdSec. These blocklists are more precise than community blocklists and provide tailored protection for your infrastructure. Learn more about threat forecast blocklists

Expanded Community Blocklist Coverage​

Unlock the premium Community Blocklist as a network participant. Receive up to 50k of the most aggressive attackers targeting similar services as yours (up from top 3k in Community).

Premium Tier Blocklist Access​

Get access to our Premium tier blocklists, providing enhanced protection with curated specialized blocklists tailored for different attack vectors.

Unlimited Blocklist Subscriptions​

Premium subscribers get unlimited blocklist subscriptions (compared to 3 in Community), allowing you to protect your infrastructure with multiple specialized blocklists simultaneously. Learn more about premium tier blocklists features

Reactivity & Monitoring​

Am I Under Attack Feature​

Receive real-time alerts when your infrastructure experiences attack surges. This feature analyzes current traffic patterns against historical baselines to detect anomalous activity, with support for email notifications and webhook integrations. Learn more about attack detection

Push Notifications Integrations​

Receive alerts when security engines go offline or become outdated, ensuring your security infrastructure remains operational. Learn more about push notifications

Increased Alert Quotas and Extended Retention​

Upgrade from the Community Plan's 500 alerts per month and 2-month retention to custom quotas (up to several million alerts) and up to 1 year of retention. This enables comprehensive monitoring of large-scale infrastructures and long-term security analysis. Learn more about premium quotas

Background Noise Filtering​

Automatically filter out internet background radiation and mass scanning activity to focus on genuine threats. Customize noise cancellation levels (Low, Medium, High) to match your security requirements. Learn more about background noise filtering

IP reputation investigation quotas​

Audit what CrowdSec knows about IP addresses, attacking you and present in blocklists, with increased investigation quotas. 100 attacker details per week (compared to 30 in Community), including IP reputation and MITRE ATT&CK mappings for comprehensive threat intelligence.

CTI API Access​

Leverage CrowdSec IP reputation data into your vendors. Get 100 CTI API calls per week (compared to 30 in Community) for integration with SIEM, SOAR, and other security tools. Learn more about CTI API