What data for this category looks like
Data for this category primarily comes from WAF, IDS, firewalls, and threat intelligence platforms. Daily generated documents include rule change tickets, blocking logs, false positive analysis reports, and policy rollback records. Fields cover rule ID, associated IP, false positive trigger frequency, policy effective time, and additional relevant fields. Data update frequency is daily or triggered by security events. Individual records include clear operating subjects, timestamps, and associated protection policy information. There is no unified aggregated standardized document structure. The length of individual logs or records varies widely.
What constraints these characteristics impose on reranking and hybrid retrieval
Decentralized data sources require retrieval sources to connect to multiple types of security devices and intelligence platforms. Hybrid retrieval of logs and documents in different formats is necessary. Real-time update frequency requirements demand support for event-triggered incremental retrieval, rather than full pull operations. Unstructured document structures require the reranking workflow to adapt to weights for different fields. For example, the false positive frequency field in blocking logs should have a higher weight than regular text fields. Wide variation in individual record lengths requires limiting the single-item length of retrieval results to avoid exceeding context window limits. Direct consequences of misjudgments in security scenarios require the reranking workflow to prioritize recalling high-confidence false positive analysis results. Basic similarity ranking cannot meet the precision requirements of this scenario.
Configuration settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Reranking Toggle | Enabled | Security scenarios require prioritizing filtering of low-confidence false positive results, and reranking can correct ranking biases from basic retrieval |
| Similarity Threshold | 0.75–0.85 | Adapts to the text characteristics of security logs, filtering irrelevant non-protection logs |
| Single Search Limit | Top 10–15 entries | Matches the daily review batch sample size of SOC teams, avoiding excessive results exceeding manual processing capacity |
| Retrieval Mode | Hybrid Retrieval | Combines vector retrieval and keyword retrieval, covering structured fields such as rule ID and IP address, as well as false positive scenarios described in natural language |
| Reranking Model Call Timeout | 30–60 seconds | Adapts to the retrieval response rhythm of security device logs, avoiding process interruptions due to excessive wait time |
| Context Window Limit | 8000–12000 token | Adapts to the single-item length characteristics of security logs, avoiding truncation of critical rule ID and false positive analysis content |
Three common configuration mistakes
- The order of retrieval results does not change after configuring the reranking model: The interface displays retrieval results sorted identically to basic vector retrieval. The cause is that the reranking toggle is not enabled, or the reranking model is not bound to the current application’s retrieval workflow.
- Unable to select the reranking model: The reranking model option on the application configuration page is grayed out and unavailable. The cause is that the reranking model parameters filled in the configuration file were not properly registered, or the key information is invalid.
- Reranking model call returns timeout: The application log displays a response timeout status code. The cause is that the single search limit parameter is set too large, causing the reranking model to process too many candidate results and exceed the interface response time limit.
How to confirm successful configuration
- Access the application configuration page of FastGPT v4.17.0, and confirm that the reranking toggle is enabled.
- Submit a known false positive sample, and check whether the retrieval results prioritize displaying content related to rules with high false positive frequency.
- Check the application’s running logs, and confirm that the reranking model call request was initiated normally with no error returns.
- Adjust the value range of the similarity threshold, and verify whether the number of retrieved results changes with the parameter adjustment.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.