What this category of data looks like
Data sources for this category include vulnerability scanners, asset inventories, CVE databases, and patch bulletins. Update frequency is weekly or monthly. Daily output documents include scan plans, vulnerability lists, remediation tickets, and rescan reports. Document fields include vulnerability IDs, associated asset IPs, risk levels, remediation statuses, rescan results, and more. A single vulnerability list can contain tens to hundreds of vulnerability entries. Rescan reports are generated per individual scan task, linked to asset and vulnerability data for the corresponding scan cycle. The core data sources for security compliance reviews are vulnerability lists and rescan reports.
What constraints these characteristics impose on the citation sources and traceability link
The multi-source data feature requires citation traceability to distinguish between native vulnerability scanner data, standard CVE database information, and patch bulletin updates, to avoid mixing credibility levels across different sources. The weekly or monthly update rhythm means citations must include the data collection cycle, to ensure timeliness and accuracy of compliance reviews. Field differences across documents require traceability to link to the unique identifier of the corresponding document, such as scan plan ID or vulnerability entry number. The false positive elimination and rescan verification steps require traceability to be traced back to the original scan results, to quickly locate abnormal data and avoid high-severity vulnerability exposure or audit deduction risks.
How to set configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average content length of a single vulnerability list or rescan report, to avoid truncating key traceability fields |
responseData | Enabled | Ensures complete metadata of the original document is returned, used to associate core traceability content such as vulnerability IDs and asset information |
detail | Enabled | Displays detailed fields of the original document, making it easier to locate specific vulnerability entries and scan cycles |
| Single recall limit | Top 3–5 entries | Matches the number of high-severity vulnerabilities reviewed in a single security operation team review, to avoid redundant information interfering with the review process |
| Similarity threshold | 0.6–0.7 | Filters low-relevance scan results, reducing the impact of false positives on traceability accuracy |
Three common mistakes
- Phenomenon: The citation source field is empty in the traceability information returned by the API. Cause: The
responseDataconfiguration item is not enabled, the original data return switch is not activated, and document metadata cannot be extracted. - Phenomenon: Required vulnerability entries still cannot be recalled after setting
quoteMaxTokento 2000 token. Cause: The set token limit exceeds the total content of the current knowledge base, or the similarity threshold is set too low, causing valid content to be filtered out. - Phenomenon: The traceability information of the rescan report is not linked to the corresponding scan cycle. Cause: The
detaildisplay configuration is not enabled, the scan cycle field of the document is not loaded, resulting in missing time dimensions in the traceability information.
How to confirm the configuration is correct
- In FastGPT v4.17.0, initiate a test query related to vulnerability scanning, and check whether the returned results include traceability fields such as vulnerability IDs and associated asset IPs.
- Check the context length of the returned results, confirm that no key content is truncated, and match the set value of
quoteMaxToken. - Verify the number of recalled traceability entries, confirm that it matches the set single recall limit.
- View the returned source data identifier, confirm that it can be linked to the original scan plan or rescan report document.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.