Cybersecurity glossary
What is the OWASP Core Rule Set (CRS)?
Learn what the OWASP Core Rule Set (CRS) is, how it powers ModSecurity-compatible WAFs, what paranoia levels mean, and how to tune CRS to block attacks without breaking applications.
Definition
The OWASP Core Rule Set (CRS) is a set of generic attack detection rules for compatible web application firewalls—commonly used with ModSecurity—that helps identify and block common web threats such as SQL injection, XSS, and protocol violations.
Why OWASP CRS matters
Writing high-quality WAF rules from scratch is expensive. The OWASP Core Rule Set (CRS) gives organizations a maintained baseline of detections for common web attacks and protocol abuse, designed to run on compatible engines such as ModSecurity.
CRS does not make applications secure by itself. It reduces noise from commodity scanners, buys time for patching, and creates visibility—when operators tune it instead of turning it off after the first false positive.
How CRS fits into a WAF
Deploy a compatible engine
Run ModSecurity or another CRS-capable WAF in the HTTP path.
Load CRS packages
Install CRS rules and configure paranoia level and anomaly thresholds.
Inspect requests
Rules evaluate URIs, headers, bodies, and other collections for attack evidence.
Score matches
Anomaly scoring aggregates signals before deciding to block or pass.
Log rule IDs
Audit events identify which rules fired for tuning and detection.
Tune exceptions
Create precise exclusions for legitimate traffic without disabling whole categories.
What CRS commonly detects
Injection attacks
SQL, OS command, and related injection patterns in parameters and bodies.
XSS probes
Script and markup injection attempts against reflected and stored sinks.
Protocol violations
Malformed HTTP usage and suspicious request characteristics.
Scanner noise
Known bad user agents and common vulnerability-scan fingerprints.
Paranoia levels and false positives
| Paranoia posture | Tradeoff |
|---|---|
| Lower | Fewer false positives; may miss obfuscated attacks |
| Higher | Stronger detection; requires more application-specific tuning |
| Detection-only rollout | Safe way to learn false positives before enforcement |
| Blocking without tuning | High risk of breaking real user journeys |
Operational checklist
- Start CRS in anomaly/detection mode and measure false positives by application route.
- Raise paranoia gradually with owners ready to write exceptions.
- Track upstream CRS releases and regression-test critical flows.
- Exclude by precise rule ID and argument, not by disabling entire rule files casually.
- Feed CRS logs to SIEM with stable request IDs for investigation.
- Redact sensitive payloads from audit logs.
- Combine CRS with secure coding SLAs; do not treat blocks as permanent fixes.
- Load-test body inspection for APIs and file uploads.
The practical takeaway
The OWASP Core Rule Set (CRS) is a community WAF rule pack for detecting common web attacks on engines like ModSecurity. Its effectiveness equals your tuning discipline and update process.
Use CRS as layered defense and visibility—not as a substitute for fixing SQL injection, XSS, and authorization bugs at the source.
Related security terms
ModSecurity
A popular open-source WAF engine commonly paired with CRS.
Web Application Firewall (WAF)
The control category that consumes rule sets like CRS.
SQL Injection (SQLi)
A major attack class CRS rules attempt to detect.
Cross-Site Scripting (XSS)
Another primary detection focus of generic WAF rules.
Frequently asked questions
What is the OWASP Core Rule Set in simple terms?
CRS is a shared library of WAF rules that look for common web attack patterns. Security teams load it into engines like ModSecurity to block or log suspicious HTTP requests.
Does CRS replace fixing vulnerabilities?
No. CRS is a virtual patching and commodity-attack defense layer. Application fixes remain required for durable security.
What is a CRS paranoia level?
Paranoia levels control how aggressive rule enabling becomes. Higher levels catch more attacks but increase false positives and tuning work.
What is anomaly scoring?
Many CRS setups assign scores to matched rules and block only when a threshold is exceeded, reducing single-rule brittleness.
Why does CRS need tuning?
Legitimate apps send unusual parameters, rich text, or API payloads that resemble attacks. Untuned blocking mode can break features.
Is CRS only for ModSecurity?
CRS targets ModSecurity-compatible rule engines. Some commercial WAFs offer CRS modes or similar generic rule packs.
How should teams update CRS?
Track upstream releases, test in staging, review changelogs for new rule IDs, and redeploy with monitored false-positive feedback loops.
References
Explore authoritative guidance and frameworks related to owasp core rule set (crs).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.