What the data for this category looks like
The data for SOC duty scenarios comes from SIEM, EDR, NDR, and threat intelligence sources, with update cycles of real-time or daily. Daily processed documents include alarm disposal tickets, duty logs, threat intelligence reports, daily and weekly reports. Fields cover alarm ID, threat level, disposal status, duty personnel, disposal duration, etc. All data follows the industry-standard security operation document structure, with no additional custom non-standard fields.
What constraints these characteristics impose on the "workflow orchestration" link
Real-time or daily updated data requires workflow nodes to match the corresponding trigger rhythm to avoid delayed processing of real-time alerts. Multi-data source access requirements mean the workflow must be configured with multiple input nodes, each associated with a different source dataset. The fixed field structure of daily documents requires variable binding to strictly correspond to standard fields to avoid reading invalid data. The time-consuming links of alarm investigation and false positive elimination require the workflow to be configured with cyclic verification and threshold filtering to prevent missed real attacks or false positive accumulation. The scheduled needs of duty rotation require the workflow to support scheduled trigger shift check nodes.
How to set configurations
The following configurations are based on FastGPT v4.17.0.
| Configuration Item | Suggested Approach | Basis for This Approach |
|---|---|---|
| Select knowledge base | Bind a dedicated knowledge base for SIEM/EDR alarm sources | Match the dedicated document library for the data sources of this category |
| Variable reference | Bind the alarm ID and disposal status fields in variables | Correspond to the standard field structure of daily documents |
| Node trigger timing | Trigger according to real-time data updates, interval of 600 seconds | Match the real-time or daily update data rhythm |
| Maximum cycle count | First 10 cycles, calibrated based on actual testing | Avoid resource occupation caused by false positive accumulation |
| Session pop-up button | Configure as "Submit Disposal Ticket", bind the node ID nodeId | Meet the interactive requirement of user submission clicks |
| Mermaid call configuration | Pass threat topology data to generate flowcharts | Meet the visualization needs of alarm investigation |
Three common mistakes
- Failure to bind the corresponding fields in
variableswhen configuring variable references results in empty fields being read by workflow nodes. This occurs because the standard field structure of daily documents is not matched, and data source fields are not correctly associated. - Failure to set a maximum count for cycle nodes causes the workflow to run continuously and trigger timeouts when false positives accumulate. This occurs because the false positive processing requirements of the most time-consuming links in this category are not considered, and cycle counts are not limited.
- Failure to pass correct data source parameters when calling Mermaid to generate flowcharts results in invalid returned image links. This occurs because the topology data format of threat intelligence sources is not matched, and call parameters are not correctly configured.
How to confirm the configuration is complete
- Trigger a test alarm to check whether the workflow automatically reads the corresponding alarm data in
variables. - Simulate more than 10 false positives to check whether the cycle node stops running after the preset number of times.
- Click the "Submit Disposal Ticket" button in the session pop-up to check whether the bound
nodeIdnode is triggered and a disposal ticket is generated. - Call the Mermaid node to check whether the returned image link is accessible normally and matches the alarm topology structure.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.