crowdsecurity/crowdsec · error

no zones defined

Error message

no zones defined

What it means

CustomRule.Convert validates that an appsec rule has at least one way to match: a zones list, an `and` group, or an `or` group. A rule with none of these cannot be compiled into a modsecurity/Coraza rule, so Convert returns this error and the whole rule collection fails to load.

Source

Thrown at pkg/appsec/appsec_rule/appsec_rule.go:53

type CustomRule struct {
	Name      string   `yaml:"name"`
	Severity  string   `yaml:"severity"`
	Zones     []string `yaml:"zones"`
	Variables []string `yaml:"variables"`

	Match     Match        `yaml:"match"`
	Transform []string     `yaml:"transform"` //t:lowercase, t:uppercase, etc
	And       []CustomRule `yaml:"and,omitempty"`
	Or        []CustomRule `yaml:"or,omitempty"`

	BodyType string `yaml:"body_type,omitempty"`
}

// Convert renders the rule; ruleIndex is its position in the collection, used
// to keep ids unique across rules that share identical leaves.
func (v *CustomRule) Convert(ruleType string, appsecRuleName string, appsecRuleDescription string, ruleIndex int) (string, []uint32, error) {
	if v.Zones == nil && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no zones defined")
	}

	if v.Match.Type == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match type defined")
	}

	if v.Match.Value == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match value defined")
	}

	switch ruleType {
	case ModsecurityRuleType:
		r := ModsecurityRule{}
		return r.Build(v, appsecRuleName, appsecRuleDescription, ruleIndex)
	default:
		return "", nil, fmt.Errorf("unknown rule format '%s'", ruleType)
	}
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a zones list to the rule, e.g. `zones: [URI]`
2. Or wrap the matching conditions in an `and:` / `or:` group if combining conditions
3. Check YAML indentation so the zones field is actually attached to the rule object

Example fix

// before
- match:
    type: contains
    value: bad-string

// after
- zones:
    - URI
  match:
    type: contains
    value: bad-string

func (r CustomRule) hasMatcher() bool {
    return r.Zones != nil || len(r.And) > 0 || len(r.Or) > 0
}

When it happens

Trigger: Defining an appsec rule entry with empty `zones:`, no `and:` and no `or:` keys (e.g. only `match:` given), then calling Convert during collection loading.

Common situations: A hand-written YAML rule where the zones block was accidentally deleted or indented so it is not parsed into the CustomRule struct; a rule with only `match: {type: regex, value: ...}` but no zone.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• no match type defined
• no match value defined
• leaf rule must have zones
• rule has no zones, 'and', or 'or' children
• invalid schema name

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b9d8b970350d4dcd. Report an issue: GitHub.