ModSecurity 2.5 collections
The following collections are available in ModSecurity 2.5:
Some collections have fixed fields, such as the GEO collection, which contains fields such as COUNTRY_NAME and CITY. Other collections, such as REQUEST_HEADERS have variable field names - in the case of REQUEST_HEADERS it depends on which headers were sent by the client.
It is never an error to specify a field name that doesn't exist or doesn't have a value set - so specifying REQUEST_HEADERS:Rubber-Ducky always works - the value would not be tested against if the client hasn't sent a Rubber-Ducky header.