This content is based on FastGPT v4.17.0.
What data looks like for this category
Data sources for this category include SIEM, EDR, NDR, and various threat intelligence feeds. Update cadence falls into two categories: real-time and daily. Four types of documents are processed regularly: alert disposal sheets, duty logs, threat intelligence bulletins, and daily/weekly reports. Alert disposal sheets include fields such as alert time, source IP, and disposal status. Duty logs include fields such as duty period, abnormal items, and processing results. Threat intelligence bulletins include fields such as threat type and impact scope. Daily/weekly reports include statistical fields such as total daily alerts and disposal rate.
What constraints these characteristics impose on model access and configuration
Real-time alert data requires model access configuration to support low-latency responses, to avoid alert buildup from processing delays. Multi-source heterogeneous document structures require configuration to adapt to different input formats. Reasonable context and token ranges must be defined. Daily-updated daily/weekly report documents require batch processing, so the single-processing limit of the model must be adjusted to avoid exceeding the model's capacity. Field differences across data sources require configuration to define the range of information the model can extract, ensuring key fields are accurately identified.
How to set configurations
| Configuration Item | Recommended Range | Rationale |
|---|---|---|
maxContext | 8000–12000 token | Adapts to the total field count of single documents such as alert disposal sheets and duty logs, avoiding truncation of critical information |
maxTokens | 2000–3000 token | Matches output requirements for alert analysis and false positive elimination, balancing response speed and content completeness |
temperature | 0.3–0.5 | Reduces random generation probability, improves accuracy of alert analysis, and lowers false positive risk |
AIPROXY_API_ENDPOINT | Enter the root address of the AI Proxy service, for example http://aiproxy:3000. Do not append /v1 or model service paths | Configures the AI Proxy service call address for the App/Admin service, must match the deployment address of the AI Proxy server |
AIPROXY_API_TOKEN | Enter a non-empty administrator token consistent with the AI Proxy server configuration | Provides identity verification credentials for the App/Admin service and AI Proxy server, must match the token configured on the AI Proxy server and be non-empty |
quoteMaxToken | 1000–1500 characters | Limits the length of referenced source data, ensuring the compliance review content output by the model has clear supporting evidence |
Three common configuration mistakes
- Phenomenon: Model response time exceeds expectations, first token time and total runtime show inconsistent values. Cause: The
maxContextandmaxTokensparameters are not adjusted for real-time alert data, leading to excessive redundant information processed by the model and extended response cycles. - Phenomenon: App/Admin service startup verification fails, or model calls return a 401 status code. Troubleshooting steps: Check if
AIPROXY_API_TOKENis a non-empty administrator token consistent with the AI Proxy server configuration. Unconfigured or mismatched tokens will cause this issue. - Phenomenon: Compliance review results omit key alert fields. Cause: The
quoteMaxTokenvalue is too small, truncating critical information in alert disposal sheets and preventing the model from fully extracting review supporting evidence.
How to confirm correct configuration
- Call the test interface, enter a single alert disposal sheet, and verify that the compliance review content output by the model includes core fields such as alert time and disposal status.
- Check the App/Admin service startup logs, confirm that
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare correctly loaded as server environment variables, with no startup verification errors. Check model call logs, confirm that the AI Proxy call link is normal with no related error messages. - Adjust the
temperatureparameter, compare the differences between two alert analysis results, and confirm that the parameter value meets business requirements. - Batch import daily-updated daily/weekly report documents, verify the processing time and output completeness of the model, and confirm that it adapts to batch processing needs.
The values provided above are common starting points. They should be evaluated against the user’s own specific samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.