What the data for this category looks like
Vulnerability scanning service data sources include scan results produced by vulnerability scanners, asset lists maintained by operations teams, public CVE vulnerability databases, and official patch announcements. Data is updated on a weekly or monthly cycle. Daily produced documents include scan plans, vulnerability lists, remediation work orders, and rescan reports. Data fields cover asset identifiers, vulnerability CVE numbers, risk levels, remediation statuses, rescan results, and other items. All data uses structured formats, with no additional custom statistical fields.
What constraints these characteristics impose on the "citation sources and traceability" workflow
Data sources for vulnerability scanning services are dispersed, covering scanners, asset lists, CVE databases, and patch announcements. When performing citation traceability, corresponding fields from different data sources must be accurately matched to avoid confusing vulnerability information across different assets. Data is updated weekly or monthly, so the generation time of the data must be noted when citing to ensure the timeliness of traceability content. The structure of daily produced documents is fixed. When citing, the inherent field dimensions of documents such as scan plans and vulnerability lists must be matched. For example, CVE numbers extracted from vulnerability lists must be directly associated with corresponding entries in CVE databases. Structured data formats are unified, but field mapping across data sources requires strict validation to prevent association errors.
How to set configurations
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average text length of single vulnerability data entries for vulnerability scanning services, avoids truncating critical CVE descriptions and remediation requirements |
| Citation data return scope | Only associated fields | Reduces unnecessary data loading, aligns with usage scenarios for structured vulnerability data |
detail | Full display | Facilitates rapid verification of vulnerability traceability information and remediation basis for security operation teams |
| Maximum number of citations | Top 5 entries | Aligns with the typical number of vulnerabilities in a single scan, avoids content redundancy from excessive citations |
responseData | Only return structured fields | Adapts to the structured data format of vulnerability scanning services, improves traceability efficiency |
Three common configuration errors
- Symptom: The maximum number of citations is configured as 3, but 7 vulnerability traceability citations are returned. Cause: The typical vulnerability count characteristic of a single scan for vulnerability scanning services was not matched, generic configurations were applied directly, and parameters were not adjusted based on category-specific data characteristics.
- Symptom: The citation source is displayed as a local knowledge base in the interface, but corresponding vulnerability scanning data was not imported. Cause: The data source path of the vulnerability scanner was not correctly associated, resulting in irrelevant generic knowledge base content being called during traceability.
- Symptom: The cited CVE number does not match the number in the actual vulnerability list. Cause: Cross-data source field mapping relationships were not validated, and identifier fields from asset lists and CVE databases were confused.
How to confirm configurations are properly set
- Manually import a single test vulnerability data entry, trigger the code review assistance workflow, and check whether the cited content includes the correct CVE number and corresponding CVE database link.
- Adjust the value of
quoteMaxToken, observe the truncation status of cited content, and confirm that the value aligns with the text length of single vulnerability data entries. - Check whether the update time displayed in citations matches the execution cycle of the scan plan, ensuring that the traceability content is labeled with the correct data generation time.
- In FastGPT v4.17.0, verify that when
responseDatais configured to only return structured fields, the cited content contains no redundant unstructured text.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.