Add threat forecast docs

crowdsec-docs/sidebarsUnversioned.js

@@ -219,6 +219,15 @@ module.exports = {
                 label: "Decisions Management 🏅"
             }],
         },
+        {
+            type: "category",
+            label: "Threat Forecast 🏅",
+            link: {
+                type: "doc",
+                id: "console/threat_forecast",
+            },
+            items: [],
+        },
         {
             type: "category",
             label: "Enterprise support 🏅",

crowdsec-docs/unversioned/console/threat_forecast.md

@@ -0,0 +1,13 @@
+# Threat Forecast
+
+> 🌟 Premium feature
+
+The Threat Forecast is a special blocklist for paying customers. It provides an additional layer of security on top of the community blocklist. In contrast to the community blocklist it is generated on a per-organization basis to deliver more precise protection based on the signals shared by the organization. 
+
+## Enabling the Threat Forecast
+
+The Threat Forecast is automatically enabled after a plan upgrade. Similar to the community blocklist, the Threat Forecast blocklist is also automatically pushed to all your security engines. Users that want more finegrained control over their subscription can manage the blocklist under the blocklist tab in their console. For more detail, check the [blocklist page](/console/blocklists/subscription.md).
+
+## Disabling the Threat Forecast
+
+To disable the Threat Forecast, simply unsubscribe your organization or engines from in inside the blocklist catalog. This will remove the decisions from your engine. After a while this will stop your Threat Forecast from being recomputed. To turn it on again, subscribe your engines or organization and the recompute should restart within a 24h window.