What data for this category looks like
Data for this category comes from SIEM, EDR, firewall logs, and host images. Update frequency is real-time or triggered per single incident. Daily produced documents include incident response reports, forensics records, disposal plans, and notification materials. Document fields include incident ID, attack source IP, disposal time, evidence chain hash value, etc. There are no unified fixed units; adjustments are made flexibly based on the record items of each individual document.
What constraints these characteristics impose on the workflow orchestration link
Decentralized, real-time updated data sources require workflows to support asynchronous pull nodes for multiple data sources. This prevents single-node blocking from causing data delays. Fluctuations in single-incident data volume require configuring dynamic context thresholds to adapt to content lengths for different scenarios. Unified formats are not available for fields in forensics records and notification materials. A field mapping node must be added to complete standardization processing. Delayed regulatory reports can lead to compliance risks. A timeout alert node must be set to ensure the disposal process is completed before the incident is closed. Additionally, the multi-step evidence chain collation link requires configuring dependency trigger rules between nodes. This prevents process interruptions from causing disposal delays.
How to set configurations
The following configurations are formulated based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Single search limit | Top 5-10 entries | The data sources for this category have many log entries. Too many entries will exceed context limits, while too few will fail to cover attack path clues |
| Maximum context | 8000-12000 characters | The content length of incident response reports and forensics records varies widely. This setting adapts to document content of different volumes and avoids truncating critical evidence |
| Timeout duration | 600 seconds | Real-time pulled log data may have delays. A 600-second timeout covers most abnormal pull scenarios and prevents unnecessary process blocking |
| Variable mapping | Associate node outputs by incident ID | Data for this category is centered on incidents. Incident IDs must be used to link input and output across multiple nodes to ensure correct data attribution |
| Node dependencies | Trigger in incident completion order | Attack path restoration requires prior parsing of forensics records. Isolation disposal must wait for attack source localization to complete. Dependencies must be set according to business logic |
| Retry count | 2-3 times | Firewall logs may have temporary pull failures. Limited retries reduce the probability of process interruptions and avoid impacting incident response timeliness |
Three common mistakes
- Phenomenon: When calling knowledge base search in a workflow, the number of returned references is only under 3000, and cannot match the 13000 limit configured in the application. Cause: The reference limit is not separately configured in the workflow's knowledge base node. The default inherits the workflow's global limit and is not adjusted for security incident scenarios.
- Phenomenon: When connecting multimodal logs and plain text instructions in a workflow at the same time, all content is sent to the plain text model for processing, and the multimodal model is not triggered. Cause: No data type judgment node is set in the workflow, and input content is not routed to the corresponding model node based on format.
- Phenomenon: When calling a workflow, input plain text questions automatically trigger the document parsing process, resulting in response delays. Cause: The document parsing switch not triggered by the knowledge base is not turned off in the workflow's global settings, or the parsing step is not explicitly skipped in the node.
How to confirm the configuration is complete
- Manually trigger a single-incident test workflow, and check whether the input and output data of each node matches the original logs and forensics records.
- View the workflow's node dependency configuration, and confirm whether the attack path restoration node starts after the forensics record parsing node is completed.
- Simulate an abnormal pull scenario, and verify whether the timeout alert node triggers a prompt after the set duration.
- Adjust the format of input data, and confirm that multimodal and plain text content is routed to the corresponding model nodes.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.