What Data Looks Like for This Category
This category processes data primarily from SIEM, EDR, NDR, and third-party threat intelligence sources. Data update cadence has two modes: real-time alert streams and daily summary reports. Daily processed and generated documents include alert disposition sheets, duty logs, threat intelligence briefings, and weekly and monthly security daily reports. A single alert disposition sheet includes fields for alert ID, associated assets, trigger time, and disposition status. Duty logs include fields for duty period, disposition actions, and escalation records. Data fields have no custom units. Core attributes are identified only by timestamps and numeric status codes.
Constraints on Permission and Data Isolation
Real-time alert streams require low latency. Embed permission checks directly into the data flow pipeline to prevent cross-team data leaks. Field differences across multiple document types require fine-grained permission rules matched per document category. This ensures threat intelligence briefings are only visible to authorized teams. Unify mapping of data source permissions to the teamId and tmbId fields for multiple data source integrations. This avoids permission mapping confusion. For multi-account sharing within the same team, bind permission configurations to teams. This supports team permission synchronization during SSO integration. Isolate database instances across different teams for intranet deployment environments. This prevents cross-tenant data crossover.
Configuration Guidelines
This configuration applies to FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
teamId field mapping | Bind to the data source’s owning team, use values 1001–1005 | Unify team permission identifiers to meet permission check requirements for multiple data source integrations |
tmbId field completion | Automatically populate the team’s tmbId for historical document versions that lack the tmbId field | Fix permission gaps in historical version data, ensuring old data can be properly isolated |
| Real-time permission check latency | Set to 30 seconds | Match the low-latency processing requirements of real-time alert streams, preventing permission checks from slowing alert flow |
| Multi-account same-team sharing configuration | Enable team-level account sharing, set to enabled state | Meet collaboration needs for SOC analysts logging in via multiple terminals |
| SSO integration mapping rules | Map the team identifier returned by SSO to the teamId field, use the team ID from SSO callback parameters | Quickly integrate with enterprise SSO systems to implement unified permission management |
| Intranet database isolation configuration | Assign an independent database subdirectory for each team, use /data/fastgpt/team-{teamId} | Prevent cross-team data access during intranet deployment |
Three Common Misconfiguration Issues
- Symptom: Cannot create multiple logged-in accounts for the same team, or cannot properly display table data after adding. Cause: Team-level account sharing configuration is not enabled, or the
teamIdfield is not correctly bound to account permissions. - Symptom: Cannot properly synchronize team permissions after SSO integration. Cause: The team identifier from SSO callbacks is not correctly mapped to the
teamIdfield, leading to failed permission checks. - Symptom: Historical version documents in MongoDB lack the
tmbIdfield, causing permission isolation to fail. Cause: ThetmbIdfield completion operation was not performed on historical version data, so old data does not match current team permission rules.
How to Verify Successful Configuration
- Log in to accounts from different teams, verify that only alert disposition sheets, duty logs, and other documents belonging to the corresponding team are visible.
- Import historical version documents, check if the
tmbIdfield has been automatically populated, or if the manually configuredtmbIdmatches the team identifier. - After integrating with an SSO system, verify that logged-in accounts are automatically bound to the corresponding
teamIdteam permissions. - In an intranet environment, check that database directories for different teams are independent, with no cross-access.
The values provided are common starting points and should be evaluated against the reader’s own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.