This document is written based on FastGPT v4.17.0.
What data for this category looks like
Data for this category comes from SIEM, EDR, firewall logs and host images. Updates occur in real time or per event. Daily output includes incident response reports, forensics records, disposal plans and notification materials. Data fields include attack paths, isolation measures, evidence chain numbers, disposal timestamps and more. Single data volume fluctuates with incident complexity.
What constraints these characteristics impose on knowledge base retrieval and recall
Real-time or event-triggered updates require the retrieval pipeline to support incremental synchronization and low-latency recall, to prevent delays in incident handling. Mixed multi-source logs and structured document data structures require retrieval to support both keyword matching and semantic recall, covering core fields such as attack paths and disposal steps. Fluctuating single-event data volume requires limiting the context length of a single recall, to prevent exceeding the model’s context window. Retrieval results must also link accurate evidence sources, to avoid misleading subsequent handling decisions.
How to set configurations
| Configuration Item | Suggested Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Match semantic relevance related to security incidents, filter low-relevance log or report fragments |
limit | Top 8 entries | Control context length, adapt to information density in security handling scenarios, avoid model overload |
searchMode | hybrid | Combine keyword and semantic retrieval, cover structured logs and unstructured response documents |
usingReRank | Enabled | Perform secondary sorting on initial recall results, improve matching accuracy for attack path and disposal plan content |
datasetSearchUsingExtensionQuery | Enabled | Automatically expand query semantics, cover professional term variants in incident response scenarios |
Three common mistakes
- External publishing channels cannot call knowledge base results, while local testing functions normally. The cause is incorrect configuration of API permissions for the publishing channel or dataset access scope, and failure to add the corresponding
collectionIdsto the allowed access collection list. - Retrieval results include internal unique identifiers of knowledge base paragraphs, reducing the readability of handling documents. The cause is failure to configure field filtering for retrieval results, and the default returns metadata IDs generated during embedding.
- When creating a knowledge base directory, passing a parent ID parameter still results in the directory being generated in the root directory. The cause is the passed parent ID format does not meet requirements, or the directory hierarchy function is not enabled in the dataset configuration, causing the parameter to not take effect.
How to confirm configurations are correct
- Initiate a simulated security incident query, check if retrieval results include target document fragments such as incident response reports and forensics records.
- View the metadata of retrieval results, confirm that unnecessary internal IDs or non-target fields are not included.
- Test whether log data after incremental update can be retrieved within 1 minute, verifying that the real-time update configuration takes effect.
- Switch between different retrieval modes, compare result differences between keyword matching and hybrid retrieval, confirming that the
searchModeconfiguration is correct.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.