What This Category of Data Looks Like
Data for this category originates from SIEM, EDR, firewall logs, and host images. Update frequency is real-time or triggered per individual incident. Daily produced documents include incident response reports, forensic records, disposal plans, and notification materials. Most individual documents contain fields such as attack paths, disposal steps, and evidence chain details. There is no unified fixed unit, with values adjusted based on incident scenarios. Data volume fluctuates based on incident complexity. This data is primarily used for attack attribution and compliance notifications.
How These Characteristics Impact Context and Token Processing
Dispersed data sources and real-time updates require the context window to cover time-series correlated information from multi-source logs, to avoid breaking the evidence chain. Individual documents have many fields and no fixed format, leading to fluctuating token consumption. The total incoming context must be limited to prevent timeouts. Incident response scenarios have high timeliness requirements. Context recall must prioritize matching near-real-time disposal records and forensic data, while avoiding redundant token usage that causes response delays. Regulatory notifications require complete citation of all evidence fields. Context recall must cover all relevant documents. Missing critical information may lead to delays in regulatory reports.
The following configurations apply to FastGPT v4.17.0.
How to Set Configurations
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
maxContext | 8000–12000 token | Covers core correlated information from multi-source logs, forensic records, and disposal plans, preventing critical evidence from being truncated due to token limit exceedance |
quoteMaxToken | 2000–4000 token | Matches the core citation field length for incident notifications and reports, ensuring information completeness for compliance materials |
| Context recall limit | Top 6–10 entries | Limits the total context passed in a single request, preventing response timeouts due to excessive data |
| Recalled data time range | Last 72 hours | Meets the real-time requirements of incident response, avoiding outdated non-correlated log data |
Three Common Misconfigurations
- Symptom: API calls return empty context or only a single log entry. Cause: The
maxContextparameter is not configured, or its value is set too small, resulting in insufficient recall of correlated evidence. - Symptom: Citation content in incident response reports is truncated, with incomplete log fields or disposal steps displayed. Cause: The
quoteMaxTokenvalue is lower than the token consumption of the actual cited content, resulting in truncation of core information. - Symptom: Single call timeouts or token limit exceeded errors are returned. Cause: The number of recalled documents or time range for context recall is not limited, introducing excessive non-correlated log data, leading to total token consumption exceeding model limits.
How to Verify Successful Configuration
- Review the application's context recall logs to verify that the number of recalled documents and their time range match the preset configurations.
- Initiate a simulated incident query to check that the returned report content includes complete forensic records and disposal steps, with no truncation.
- Call the API to test scenarios with different levels of incident complexity, confirming that response time and token consumption fall within acceptable ranges.
- Compare recall results before and after configuration changes to confirm that parameter values affect the context scope as expected.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.