crowdsecurity/crowdsec · error

unknown zone '%s'

Error message

unknown zone '%s'

What it means

While serializing a custom appsec rule to modsecurity syntax, a zone name in rule.Zones was not found in zonesMap (the fixed zone→SecRule variable mapping). The zone string comes from the rule YAML and is invalid or misspelled.

Source

Thrown at pkg/appsec/appsec_rule/modsecurity.go:326

	r.WriteString("SecRule ")

	zonePrefix := ""
	variablePrefix := ""

	hasCount := slices.Contains(rule.Transform, "count")
	if hasCount {
		zonePrefix = "&"
	}

	for idx, zone := range rule.Zones {
		if idx > 0 {
			r.WriteByte('|')
		}

		mappedZone, ok := zonesMap[zone]
		if !ok {
			return "", fmt.Errorf("unknown zone '%s'", zone)
		}

		if len(rule.Variables) == 0 {
			r.WriteString(mappedZone)
		} else {
			for j, variable := range rule.Variables {
				if j > 0 {
					r.WriteByte('|')
				}

				r.WriteString(fmt.Sprintf("%s%s:%s%s", zonePrefix, mappedZone, variablePrefix, variable))
			}
		}
	}

	r.WriteByte(' ')

	if rule.Match.Type != "" {

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the zone name in the custom rule to one of the documented appsec zones (path, method, query, headers, body, ...)
2. Check the installed crowdsec version's zone list — newer zones may not exist on old versions

When it happens

Trigger: Thrown at pkg/appsec/appsec_rule/modsecurity.go:326 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/116f32f6cc2f40e7. Report an issue: GitHub.