What Data Looks Like for This Category
The core data for this category comes from WAF, IDS, firewall devices, and threat intelligence platforms. Daily operation and business documents include rule change tickets, blocking logs, false positive analysis reports, and policy rollback records. Document fields typically include professional technical content such as rule number, trigger characteristics, effective time, false positive rate, and associated attack types. Updates run in daily batches or in real time alongside security incidents. The volume of data updated in a single batch fluctuates based on the scale of the security event.
Constraints for Knowledge Base Retrieval and Recall
Because data sources for this category are scattered and update frequency is high, knowledge base retrieval must support unified parsing of multi-source heterogeneous data and real-time incremental synchronization. This ensures recalled content stays timely. Most documents are professional technical content, so retrieval must accurately match technical keywords. This avoids generalized recall of irrelevant general security documents. High-frequency query scenarios focus on false positive analysis and policy rollback. Recalled results must prioritize association with the customer’s actual blocking scenarios. The number of recalled results must also be controlled to prevent exceeding the large model’s context window. Additionally, security policy changes occur frequently. The retrieval link must quickly synchronize the latest rule data to avoid impacting customer technical support response efficiency.
How to Configure Settings
The following configurations are adapted for FastGPT v4.17.0:
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Matches professional terminology for security product rules, avoids recalling irrelevant general security documents, while ensuring relevance of recalled results |
limit | Top 8 entries | Security product rule documents have a large number of fields. Excessive results will exceed the large model’s context window, while this number covers common false positive and policy change scenarios |
searchMode | Semantic Retrieval | Adapts to semantic matching for technical documents, and can identify similar attack characteristics and rule descriptions better than keyword retrieval |
usingReRank | Enabled | Re-ranks initial recalled results to prioritize returning rule content with higher relevance to the customer’s current blocking logs |
datasetSearchUsingExtensionQuery | Enabled | Automatically expands retrieval terms for pre-sales Q&A scenarios. For example, expanding "WAF blocking rules" to "Web Application Firewall protection policies" to cover more relevant documents |
collectionIds | Specify exclusive security rule dataset ID | Isolates knowledge bases across different categories, ensuring the retrieval scope only covers documents related to security product rule operations, and avoids mixing content from other categories |
Three Common Misconfigurations
- Retrieval results include knowledge base documents, but the large model’s answer is concise and does not return specific clause content. The cause is that
datasetSearchUsingExtensionQueryis not enabled, and a sufficientlimitparameter is not set, resulting in key clauses not being recalled. - Knowledge base search speed is slow, and response time exceeds expectations. The cause is that a reasonable value for the
limitparameter is not restricted, orusingReRankis not enabled, causing the system to load excessive irrelevant security logs and rule data. - The number and content of recalled results for the same question vary each time. The cause is that the
similaritythreshold range is too large, orcollectionIdsis not fixed, resulting in the retrieval scope including multiple unisolated datasets.
How to Confirm Successful Configuration
- View retrieval logs to confirm that the
similarityscore of recalled results falls within the 0.75–0.85 range. - Test retrieval for pre-sales Q&A scenarios to confirm that returned results include specific clause content from rule change tickets and false positive analysis.
- Check the knowledge base synchronization status to confirm that the latest rule change data has been indexed and can be retrieved.
- Simulate high-concurrency retrieval scenarios to confirm that search response time meets expectations with no significant delay.
The values provided here are common starting points and should be evaluated against the reader’s own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.