What data for this category looks like
Data for this category comes from private vulnerability reports, code repositories, CVE numbering bodies, and official release channels. Daily documents include security advisories, vulnerability reports, fix patches, and CVE application materials. Each document is generated around a single vulnerability event, and contains fields such as CVE ID, vulnerability severity, impact scope, patch submission time, and disclosure coordination progress. Data updates follow a single vulnerability event cycle: each completed vulnerability disclosure process generates or updates the corresponding document, with no fixed batch update schedule.
What constraints these characteristics impose on knowledge base retrieval and recall
Private vulnerability reports are sensitive data before public disclosure. Retrieval must enforce strict access control, and only authorized project security response teams and authorized pre-sales personnel may call this data. Each document centers on a single vulnerability event, with strong internal content relevance but significant differences between events. Cross-event incorrect recall must be avoided. The CVE ID is the core identification field, so precise matching during retrieval must be ensured. Update frequency is triggered by individual events, so the knowledge base must support incremental updates to avoid performance loss from full reindexing. Some documents include patch code snippets and screenshots, so retrieval and recall logic must support code and multimedia content.
How to configure
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Filter low-relevance vulnerability documents, avoid recalling unrelated historical vulnerabilities or vulnerabilities from external projects |
limit | top 8 entries | Match the number of potentially related documents for a single vulnerability inquiry, balance recall coverage and context length |
searchMode | vector | Adapt to structured retrieval needs centered on CVE IDs and vulnerability severities, compatible with FastGPT v4.17.0 retrieval logic |
usingReRank | enabled | For the strong relevance characteristics of single-event documents, perform secondary sorting on recall results to optimize the relevance of top results |
datasetSearchUsingExtensionQuery | disabled | Avoid introducing unrelated non-vulnerability content via extended queries, ensure retrieval focuses on security vulnerability-related documents |
collectionIds | specify the dedicated security vulnerability knowledge base ID | Isolate knowledge base data from other categories, only retrieve documents such as security advisories and vulnerability reports for this category |
Three common configuration errors
- Phenomenon: When creating a knowledge base using the code repository URL of a public vulnerability report, the backend log prompts
cannot fetch internal url. Cause: The intranet access whitelist is not configured, or the deployment environment cannot directly access the raw format file address of the public code repository. - Phenomenon: After uploading a vulnerability report document containing patch screenshots, image content is not returned during retrieval. Cause: The image extraction function for document parsing is not enabled, or the knowledge base configuration does not enable multimedia content recall.
- Phenomenon: When retrieving vulnerability impact scope, vulnerability documents from unrelated projects are recalled. Cause:
collectionIdsis not configured to limit the dedicated knowledge base, or thesimilaritythreshold is set too low, causing unrelated content to be recalled.
How to confirm proper configuration
- Manually enter the CVE ID of a known vulnerability, verify that recall results only cover vulnerability documents for this project.
- View backend parsing logs to confirm that private vulnerability reports are not accessible to unauthorized roles.
- Trigger a simulated pre-sales query, check whether the returned results include the latest patch links and impact scope descriptions.
- Adjust the value range of
similarity, verify whether the number and relevance of recall results meet business requirements.
Note: The configuration values listed above are common starting points. Adjust them based on your own sample data and business needs.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.