What data for this category looks like
This category's data primarily comes from WAF, IDS, firewalls, and threat intelligence platforms. Daily produced documents include rule change tickets, intercept logs, false positive analysis reports, and policy rollback records. Data updates occur daily or when triggered by events. Rule change tickets contain change numbers, effective time periods, and associated protection rule IDs. Intercept logs record source IP, request path, triggered rule name, and intercept result. False positive analysis reports mark false positive scenarios and adjustment suggestions. Most data fields are linked to protection policy identifiers and business domain names, with no extra redundant business fields.
What constraints these characteristics impose on knowledge base retrieval and recall
Data sources are concentrated in security protection devices and intelligence platforms. Most data uses structured log or standardized document formats. Retrieval must match precise fields such as rule IDs and domain names. Update frequency is high. Real-time or near-real-time recall of the latest rule change and intercept data must be supported. Daily documents are mostly operation and maintenance technical content. Retrieval needs focus on rule configuration and false positive handling processes. Results strongly related to current protection policies must be prioritized for recall. Data volume grows rapidly as protection scale expands. The number of single-recall results must be controlled to avoid exceeding model processing limits. Documents for false positive analysis and policy rollback must be linked to historical event IDs. Retrieval must support filtering by specific identifiers.
This configuration applies to FastGPT v4.17.0.
How to set the configuration
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
similarity | 0.72–0.85 | Matches the precision requirements for security rules. A value too low introduces irrelevant false positive rules, while a value too high misses intercept rules in edge scenarios |
limit | Top 8–12 entries | Adapts to the single-page context length of security documents, avoids exceeding model processing limits, and covers enough associated rules and log cases |
searchMode | semantic | Addresses semantic matching needs for technical documents and logs, prioritizes recall of semantically relevant rule change and false positive analysis content |
usingReRank | Enabled | Improves the sorting priority of highly relevant results and filters low-confidence intercept logs and rule descriptions |
datasetSearchUsingExtensionQuery | Enabled | Automatically expands retrieval keywords, supplements precise fields such as rule IDs and domain names, and improves retrieval matching accuracy |
collectionIds | Bind a dedicated security rule document collection | Isolates the knowledge base for security product rule operations from other category data, avoiding mixed retrieval results |
Three common configuration errors
- Retrieval cannot specify the target knowledge base via variable references, and returned results mix documents from other categories. The cause is incorrect configuration of the
collectionIdsparameter, with no dedicated security rule document collection bound. - Image links uploaded to the knowledge base display as
input an imagein AI replies and cannot render normally. The cause is that automatic parsing configuration for knowledge base image external links is not enabled, and only original links are stored without format adaptation. - Knowledge base data processing returns empty results after local deployment. The cause is that uploaded security documents (such as intercept logs) do not follow the system's required chunking rules, or the word segmentation step does not filter unstructured binary log fragments.
How to verify correct configuration
- Initiate a retrieval request, check that returned results only include documents related to security product rule operations, with no content from other categories.
- Review the sorting of retrieval results, confirm that highly relevant rule change tickets and false positive analysis reports appear at the top.
- Test uploading a security document containing images, verify that image links or parsed content display correctly in AI replies.
- Adjust the
similarityparameter range, confirm that the matching precision of retrieval results meets the precision requirements for security rules.
The values provided are common starting points and should be measured against samples specific to the deployment.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.