What the data for this category looks like
Data sources for cybersecurity intelligent due diligence reports include vulnerability scan archives, penetration test records, asset mapping datasets, compliance audit documents, and more. Update cadence varies by type: vulnerability information is updated in real time or daily, asset lists are synced weekly, and compliance reports are updated quarterly or annually. Document structure includes asset details (IP addresses, ports, component versions), vulnerability details (CVE IDs, CVSS scores, remediation solutions), compliance item matching results, risk level summaries, and more. Fields include numeric port numbers, CVSS scores, string-type CVE IDs, asset names, and time-type remediation deadlines.
What constraints these characteristics impose on multi-turn dialogue and prompt engineering
Technical fields in cybersecurity due diligence reports are dense and highly correlated. Multi-turn dialogue must accurately retain key identifiers such as asset IDs and CVE IDs, to avoid repeated questions or confusion between different risk entries. Data update frequency is high, so prompts must explicitly require calling the latest knowledge base entries to ensure responses match current vulnerability remediation status. A large share of content comes from long documents, so documents must be split reasonably and recall scope limited, to avoid irrelevant general security content interfering with dialogue logic. During multi-turn follow-up questions, automatically associate asset and risk information within the context, so users do not need to repeat providing basic parameters.
How to set configurations
| Configuration Item | Recommended Value Range | Rationale |
|---|---|---|
maxContext | 8000–12000 characters | Cybersecurity due diligence reports contain long technical descriptions and multiple asset entries. Sufficient context retains key information such as asset IDs and CVE IDs across multi-turn dialogue |
recallCount | Top 10 entries | Due diligence reports cover multi-dimensional risks. Sufficient recalled entries can match associated information across different assets and vulnerabilities |
similarityThreshold | 0.75–0.85 | Filter low-match irrelevant documents to avoid mixing in unrelated general security documents |
PARSE_FILE_TIMEOUT_SECONDS | 300 seconds | Parsing large penetration test reports or asset mapping datasets takes significant time. This setting prevents timeout interruptions during processing |
UPLOAD_FILE_MAX_SIZE | 2000 MB | Supports uploading bulk large-volume files such as vulnerability scan archives and compliance reports |
rerankTopK | Top 5 entries | Reorder recalled results and retain the most relevant technical entries, improving the accuracy of responses during multi-turn dialogue |
This page provides parameter values as common starting points for configuration. Actual values are affected by material format, data volume and business rules. Specific issues require case-by-case analysis. It is recommended to test on your own samples before finalizing values.
Three common mistakes
- Symptom: After uploading a local knowledge base file, the data processing stage shows empty content with no parsed text blocks. Cause: The uploaded file exceeds the
UPLOAD_FILE_MAX_SIZElimit, or parsing duration triggers thePARSE_FILE_TIMEOUT_SECONDSthreshold, leading to interrupted processing. - Symptom: The knowledge base search node in the workflow runs normally during debugging, but the AI dialogue stage does not reference the configured due diligence report content, and only returns general Q&A. Cause:
similarityThresholdis set too high, filtering out exclusive risk matching results in the due diligence report, or the knowledge base association switch is not enabled. - Symptom: After calling the dialogue API, the
conversation_id,query, andresponsefields are not generated in the corresponding MongoDB collection, making dialogue history unavailable. Cause: Dialogue history storage configuration is not enabled, or the API request does not carry a valid session identifier parameter.
How to verify configurations are set correctly
- Upload a small cybersecurity vulnerability report, check if parsed text blocks are generated during the data processing stage, to confirm that the
UPLOAD_FILE_MAX_SIZEandPARSE_FILE_TIMEOUT_SECONDSconfigurations take effect. - Initiate multi-turn dialogue: first ask for the CVE ID of a specific asset, then follow up with a request for corresponding remediation suggestions. Check if the response associates the previously mentioned asset and vulnerability number, to confirm that the
maxContextconfiguration retains context information. - Call the dialogue API, check if the returned results include the
knowledge_retrievedfield, to confirm that the knowledge base recall logic is triggered normally. - View the corresponding MongoDB collection, confirm that fields such as
conversation_id,query, andresponseexist, to confirm that dialogue history storage configuration is enabled.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-09-14.