What the Data for This Category Looks Like
Vulnerability scanning service data primarily originates from vulnerability scanners, asset inventories, CVE databases, and patch advisories, with weekly or monthly update frequencies. Four types of documents are generated daily: scan plans, vulnerability lists, remediation tickets, and rescan reports.
Scan plans include asset scope and scan cycle fields. Vulnerability lists include vulnerability IDs, CVSS scores, and impact scope fields. Remediation tickets include responsible remediation personnel and deadline fields. Rescan reports include remediation results and missed vulnerability fields.
The data structure is fixed, and field types align with source systems.
What Constraints These Characteristics Bring to the Workflow Orchestration Phase
Since data comes from multiple sources with fixed update rhythms, workflow orchestration requires configuring cross-source data pull nodes to ensure consistency of asset scope and vulnerability data.
Since document structures are fixed and fields are clearly defined, establish variable mapping rules in the orchestration to map fields from different documents to the input and output of workflow nodes.
Since the most time-consuming steps are asset scope confirmation, false positive elimination, and rescan result verification. Embed manual review nodes in the workflow, automatically intercept abnormal data before routing to corresponding steps.
Since the consequences of errors include high-risk vulnerability exposure, missing patches, or audit deductions, configure failure alert nodes to trigger notifications when node execution encounters exceptions.
Additionally, match the data update frequency to set workflow trigger cycles to avoid redundant data pulls or delayed processing.
Configuration Settings
These configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Data Source Pull Cycle | Trigger weekly or monthly | Matches the weekly or monthly update frequency of vulnerability scanning services, avoids redundant data pulls |
| Asset Scope Validation Node | Enable manual review steps | Asset scope confirmation is a core time-consuming step, manual confirmation is required before proceeding to subsequent processes |
| False Positive Filter Threshold | Automatically filter vulnerabilities with CVSS scores below 3.0 | Based on the false positive elimination needs of vulnerability scanning services, reduces manual verification costs |
| Global Variable Mapping Rules | Bind fields from scan plans and vulnerability lists one-to-one | Matches the document structure of vulnerability scanning services, ensures accurate data flow |
| Failure Alert Trigger | Trigger when node execution times out after 600 seconds or returns an error code | Consequences of errors including high-risk vulnerability exposure require timely notification of relevant personnel |
| Rescan Result Verification Node | Automatically compare vulnerability data before and after remediation | Rescan result verification is a core step, improves verification efficiency |
Three Common Misconfigurations
- Phenomenon: Global variables do not take effect after workflow execution, and external calling interfaces return empty fields. Cause: Global variable pass-through is not enabled in workflow release configuration, and externally passed parameters are not bound to global variable nodes.
- Phenomenon: Multi-layer branch nodes interrupt execution after running, and cannot jump to the corresponding link as selected by the user. Cause: The conditional logic of branch judgment is not configured correctly, and the selection result from user input is not bound to the node's judgment parameters.
- Phenomenon: Custom variables cannot be added or spliced, and the spliced content does not match the document. Cause: The type of custom variable is not declared correctly in workflow variable configuration, and content is not spliced according to the format requirements of document fields.
How to Verify the Configuration Is Correct
- Trigger a test workflow, check whether the input and output of each node match the preset scan plan and vulnerability list fields.
- Simulate an external platform calling the interface to verify that incoming parameters can be correctly passed to the global variable node of the workflow.
- Manually trigger an exception scenario to check whether the failure alert is triggered as configured and whether the workflow routes to the corresponding review link.
- View the workflow running logs to confirm that the execution cycle of each node matches the preset weekly or monthly rhythm.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.