What Data for This Category Looks Like
The data for this category primarily comes from target systems, public vulnerability databases, automated scanner results, and manual verification records. It includes manually validated attack paths and exploit chain analysis content, which differs from the pure scan data of general vulnerability scanning services. Daily deliverable documents include test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Data updates follow cycles of individual projects or major version iterations. Document structures include fields such as project identifiers, vulnerability IDs, verification steps, and risk ratings. There is no unified fixed unit, and adjustments are made based on project scenarios.
What Constraints Do These Characteristics Impose on the "Source Citation and Traceability" Link
Dispersed data sources and reliance on manual verification steps require cross-validation by associating multi-source data during traceability. Update cycles are tied to individual projects, so data source ranges must be reconfigured each time a project starts. Document fields are non-standardized, so custom field matching rules must be supported. Manual verification records have strong timeliness, so the time range for context citations must be limited. Additionally, penetration testing services involve authorization and compliance requirements. Traceability results must clearly mark the authorization status of data sources to avoid citing content without authorization.
How to Configure Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Adapt to the content length of long documents such as penetration test reports and vulnerability reproduction records |
| Number of source data records recalled per request | Top 3–5 | Focus on core vulnerability-related data sources for the current project and avoid redundant information |
| Contextual time filtering threshold | Last 180 days | Match the project-based data update frequency of this category, and filter expired scan or verification records |
responseData | Return only original knowledge base content | Ensure that content such as vulnerability rectification suggestions and reproduction steps is output exactly as it appears in the source |
detail | Enabled | Support displaying detailed information such as document type and verification time of data sources to meet compliance traceability requirements |
Three Common Mistakes
- Issue: Parameter format errors occur when configuring data source ranges, and configurations cannot be saved. Cause: Data source matching rules are not correctly configured using project-bound document identifiers, and incompatible variable formats are used incorrectly.
- Issue: Only AI-generated content is returned during citation and traceability, and no source data is displayed. Cause: The citation detail display switch is not enabled, or the response data output mode is not set correctly.
- Issue: Output vulnerability rectification suggestions have been rewritten by AI and do not match the original knowledge base content. Cause: The output mode set to return only original knowledge base content is not enabled, causing the AI to modify the original source text.
How to Verify Successful Configuration
- In the FastGPT v4.17.0 test environment, upload a single fragment of a vulnerability reproduction record as test data, trigger the corresponding question-and-answer request, and check whether the returned content matches the original knowledge base content.
- View the traceability display area of the question-and-answer results to confirm whether detailed information such as the document type and verification time of the data source is displayed.
- Adjust the contextual time filtering threshold to verify that the system only recalls data sources within the corresponding time range.
- Check the system logs after saving the configuration to confirm that there are no error messages related to data source matching or parameter formats.
The values listed above are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.