What the data for this category looks like
Data sources for cybersecurity intelligent due diligence reports include public vulnerability databases, internal penetration test archives of financial institutions, third-party threat intelligence platforms, and industry compliance audit reports. Update frequencies vary: vulnerability data is synced in real time, compliance documents are updated quarterly, and asset lists are updated weekly as enterprise assets change.
The document structure of a single report includes an asset ledger (including IP/domain, affiliated business line), vulnerability details (including CVE ID, CVSS score, impact scope), threat event trace records, rectification priority list, and compliance matching items. Fields include: CVE ID (string format), CVSS score (numeric, unit: points), asset IP (IPv4/IPv6 format), rectification deadline (unit: days), and event occurrence time (timestamp format).
What constraints do these characteristics impose on the knowledge base retrieval and recall workflow
Differing update frequencies across multi-source heterogeneous data require staged incremental sync tasks to avoid full sync reindexing of old data. A high proportion of structured fields requires precise retrieval support for fields such as CVE ID, CVSS score, and asset IP. Full-text retrieval alone cannot cover these requirements. Single documents have long length, so segmented retrieval must retain the association between vulnerabilities and corresponding assets to avoid breaking contextual logic during splitting. Many time-sensitive fields require time range recall based on event occurrence time and rectification deadline, to filter expired risk information.
How to set the configuration
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
maxContext | 8000–12000 characters | Single cybersecurity due diligence report documents are typically long, requiring sufficient context to retain the association between vulnerabilities and assets |
recall_top_k | Top 10–15 results | Due diligence reports need to cover multi-dimensional risk points. Too many recalled results increase context processing load, while too few will miss associated risks |
similarity_threshold | 0.75–0.85 | Balance precision and recall coverage, avoid mistakenly recalling irrelevant compliance documents or low-risk entries |
PARSE_FILE_TIMEOUT_SECONDS | 600 seconds | Long document parsing takes significant time, preventing premature termination of the parsing process due to timeout |
structured_field_index | CVE ID, CVSS score, asset IP | These are high-frequency precise retrieval fields, requiring separate inverted indexes to improve retrieval efficiency |
incremental_sync_interval | Every 1 hour | Vulnerability data updates frequently, requiring timely syncing of the latest threat intelligence information |
The parameter values provided on this page are common recommendations used as a starting point for configuration. Actual values are affected by material form, data volume, and business rules. Each case requires specific analysis. It is recommended to test on your own samples before finalizing settings.
Three common mistakes
- Phenomenon: Retrieval returns
400 Bad Request, with logs showingjson parse error. Cause: No validation is performed on the JSON output format of third-party threat intelligence, leading to exceptions when parsing structured fields. - Phenomenon: Retrieved report fragments contain garbled text. The garbled text disappears after switching to a non-thinking model. Cause: No encoding format is configured for knowledge base documents, leading to failed decoding of professional abbreviations and special symbols in cybersecurity reports.
- Phenomenon: Uploaded penetration test topology documents do not generate searchable text indexes. Cause: The OCR parsing component is not enabled in the deployment environment, unable to extract asset IP and vulnerability ID information from images.
How to confirm configuration is complete
- Run an upload and parsing task for a single cybersecurity due diligence report, check if successful structured field extraction is displayed in the parsing logs.
- Initiate a precise retrieval that includes a CVE ID, verify that matching fields in returned results align with the search term.
- Check the running logs of incremental sync tasks, confirm that newly added vulnerability data from the past hour has completed index updates.
- Upload a document containing a topology diagram, confirm that the parsing result includes text fragments extracted from the image.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-09-14.