crowdsecurity/crowdsec · error

unknown rule format '%s'

Error message

unknown rule format '%s'

What it means

CustomRule.Convert was called with a ruleType that does not match any known converter (only the modsecurity rule type is registered). The custom appsec rule's declared format is unrecognized, so it cannot be translated into a native rule.

Source

Thrown at pkg/appsec/appsec_rule/appsec_rule.go:69

func (v *CustomRule) Convert(ruleType string, appsecRuleName string, appsecRuleDescription string, ruleIndex int) (string, []uint32, error) {
	if v.Zones == nil && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no zones defined")
	}

	if v.Match.Type == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match type defined")
	}

	if v.Match.Value == "" && v.And == nil && v.Or == nil {
		return "", nil, errors.New("no match value defined")
	}

	switch ruleType {
	case ModsecurityRuleType:
		r := ModsecurityRule{}
		return r.Build(v, appsecRuleName, appsecRuleDescription, ruleIndex)
	default:
		return "", nil, fmt.Errorf("unknown rule format '%s'", ruleType)
	}
}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the rule's format field — custom appsec rules currently only support the modsecurity format
2. Remove or disable the malformed rule from the appsec config or hub collection

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/appsec_rule.go:69 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5735a443da24ea13. Report an issue: GitHub.