What the data for this category looks like
Typical entities for this category include security operations teams, enterprise internal training departments, and external security service providers. Daily generated documents fall into four categories: training courseware, phishing drill plans, phishing email templates, and drill result reports. Data sources cover employee contact lists, enterprise email gateways, internal training platforms, and user click statistics. Document update frequency is usually quarterly or annually. Core time-consuming steps focus on drill audience screening, email template design, and result review. Errors may lead to employee data leakage risks, audit gaps, or lack of valid evidence for rectification.
Constraints for knowledge base retrieval and recall
Diverse document types and clear associated scenarios require retrieval and recall to accurately match keywords such as drill scenarios and audience tags. It prevents interference from irrelevant content. Data update frequency is low. Frequent incremental synchronization is not needed. But recall results must align with current training plans. Data from multiple sources has format differences. Retrieval must support unified matching logic across document types. Pain points in core time-consuming steps require quick retrieval of previously reused templates and plans. Support for quick filtering of results by scenario tags reduces manual screening costs.
How to set configurations
Under FastGPT v4.17.0, the following configuration items adapt to the retrieval needs of this category:
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Balances relevance matching for phishing email templates and drill plans. Avoids returning irrelevant documents if set too low, and missing content for applicable scenarios if set too high |
limit | 3–5 items | Adapts to single-scenario retrieval needs. Avoids excessive results increasing screening costs for pre-sales and technical support staff |
searchMode | Full-text search | Supports retrieving keyword-matched content from training courseware, email templates, and drill reports. Covers multiple document types |
usingReRank | Enabled | Re-ranks initial recall results by relevance. Improves accuracy for drill plans and email templates |
collectionIds | Specify exclusive dataset IDs | Ensures only documents such as training courseware and drill plans for this category are retrieved. Prevents mixing in content from other categories |
datasetSearchUsingExtensionQuery | Disabled | This category has low document update frequency. No additional query expansion is needed. Avoids introducing irrelevant content |
Three common configuration mistakes
- Phenomenon: Retrieval returns only 1 result. It fails to meet the need for comparing multiple drill plans. Cause: The
limitparameter is set to 1. This does not adapt to the business scenario of reusing multiple documents in this category. - Phenomenon: Retrieval interface response is slow. Time exceeds reasonable limits. Cause: Retrieval parameters are not adjusted based on the category's document volume. Or, after enabling
usingReRank, the initial recall count is not limited. This leads to excessive computing resource usage. - Phenomenon: Retrieval results include security baseline check documents. Cause: Exclusive datasets are not specified via
collectionIds. This causes the retrieval scope to cover document collections from other categories.
How to confirm proper configuration
Submit a query containing phishing email keywords. Check if returned results include corresponding drill plans or email template documents. View the number of retrieval results. Confirm it matches the preset limit parameter value range. Adjust the similarity parameter value. Observe changes in the relevance of returned results. Verify the threshold setting meets business requirements. Check the dataset association configuration. Confirm only training courseware, drill plans, and other documents for this category are included. No cross-category content is mixed in.
The values provided are common starting points. They should be evaluated against the specific samples used in the actual deployment context.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.