diff --git a/detection_rules/rule_validators.py b/detection_rules/rule_validators.py index 9b3f412c885..cdfddcb365b 100644 --- a/detection_rules/rule_validators.py +++ b/detection_rules/rule_validators.py @@ -924,10 +924,21 @@ def remote_validate_rule( # noqa: PLR0913 # mismatch error, as the EsqlSchemaError and EsqlSyntaxError errors from the stack # will not be impacted by the difference in schema type mapping. mappings_lookup: dict[str, dict[str, Any]] = {stack_version: combined_mappings} - versions = get_stack_versions() - for version in versions: + # Skip stacks below the rule's floor: it is never backported there, and resolving an older + # integration package that predates the rule's data sources raises a spurious + # EsqlUnknownIndexError. No floor means validate every supported stack, as before. We do not + # skip the error at/above the floor; there it correctly flags an unreleasable floor. + min_stack = ( + Version.parse(metadata.min_stack_version, optional_minor_and_patch=True) + if metadata.min_stack_version + else None + ) + for version in get_stack_versions(): if version in mappings_lookup: continue + if min_stack is not None and Version.parse(version) < min_stack: + self.log(f"Skipping {version} stack: below rule min_stack_version {min_stack}") + continue _, _, combined_mappings = prepare_mappings( elastic_client, indices, event_dataset_integrations, metadata, version, self.log )