From a646e91caf65506ba92627a9d1fcc5e52d74ab24 Mon Sep 17 00:00:00 2001
From: Emanuel Seemann <3380606+seemanne@users.noreply.github.com>
Date: Fri, 10 Jan 2025 12:13:44 +0100
Subject: [PATCH 1/2] add threat forecast docs

---
 crowdsec-docs/sidebarsUnversioned.js                |  9 +++++++++
 .../unversioned/console/threat_forecast.md          | 13 +++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 crowdsec-docs/unversioned/console/threat_forecast.md

diff --git a/crowdsec-docs/sidebarsUnversioned.js b/crowdsec-docs/sidebarsUnversioned.js
index 7cda202f..e23fa8ef 100644
--- a/crowdsec-docs/sidebarsUnversioned.js
+++ b/crowdsec-docs/sidebarsUnversioned.js
@@ -219,6 +219,15 @@ module.exports = {
                 label: "Decisions Management 🏅"
             }],
         },
+        {
+            type: "category",
+            label: "Threat Forecast 🏅",
+            link: {
+                type: "doc",
+                id: "console/threat_forecast",
+            },
+            items: [],
+        },
         {
             type: "category",
             label: "Enterprise support 🏅",
diff --git a/crowdsec-docs/unversioned/console/threat_forecast.md b/crowdsec-docs/unversioned/console/threat_forecast.md
new file mode 100644
index 00000000..58c49808
--- /dev/null
+++ b/crowdsec-docs/unversioned/console/threat_forecast.md
@@ -0,0 +1,13 @@
+# Threat Forecast
+
+> 🌟 Premium feature
+
+The Threat Forecast is a special blocklist for paying customers. It provides an additional layer of security on top of the community blocklist. In contrast to the community blocklist it is generated on a per-organization basis to deliver more precise protection based on the signals shared by the organization. 
+
+## Enabling the Threat Forecast
+
+The Threat Forecast is automatically enabled after a plan upgrade. Similar to the community blocklist, the Threat Forecast blocklist is also automatically pushed to all your security engines. Users that want more finegrained control over their subscription can manage the blocklist under the blocklist tab in their console. For more detail, check the [blocklist page](/console/blocklists/subscription.md).
+
+## Disabling the Threat Forecast
+
+To disable the Threat Forecast, simply unsubscribe your organization or engines from in inside the blocklist catalog. This will remove the decisions from your engine. After a while this will stop your Threat Forecast from being recomputed. To turn it on again, subscribe your engines or organization and the recompute should restart within a 24h window.
\ No newline at end of file

From e97bd6efa5c9f16c80e6153dda45137d0369ff57 Mon Sep 17 00:00:00 2001
From: JDEV <rr404@users.noreply.github.com>
Date: Thu, 16 Jan 2025 17:11:43 +0100
Subject: [PATCH 2/2] Update
 crowdsec-docs/unversioned/console/threat_forecast.md

---
 crowdsec-docs/unversioned/console/threat_forecast.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crowdsec-docs/unversioned/console/threat_forecast.md b/crowdsec-docs/unversioned/console/threat_forecast.md
index 58c49808..e7f1bfe3 100644
--- a/crowdsec-docs/unversioned/console/threat_forecast.md
+++ b/crowdsec-docs/unversioned/console/threat_forecast.md
@@ -2,7 +2,8 @@
 
 > 🌟 Premium feature
 
-The Threat Forecast is a special blocklist for paying customers. It provides an additional layer of security on top of the community blocklist. In contrast to the community blocklist it is generated on a per-organization basis to deliver more precise protection based on the signals shared by the organization. 
+The Threat Forecast is a special blocklist for enterprise organizations.  
+It provides an additional layer of security on top of the community blocklist. In contrast to the community blocklist it is generated on a per-organization basis to deliver more precise protection based on the signals shared by the organization. 
 
 ## Enabling the Threat Forecast