Technical Documentation and API Q&A for Security Training and Phishing Drills: Vector Models and Indexes

The typical data subjects for this category are security operations teams, internal enterprise training departments, and external security service

What the Data for This Category Looks Like

The typical data subjects for this category are security operations teams, internal enterprise training departments, and external security service providers. Daily generated documents fall into four categories: training courseware, phishing drill plans, phishing email templates, and drill result reports. Data sources include employee contact lists, enterprise email gateways, internal training platforms, and employee click statistics. Most data updates occur quarterly or annually. Core time-consuming steps include drill audience filtering, email template design, and drill result review. Associated data scenarios include improving personnel security awareness and meeting compliance audit requirements.

Constraints Imposed on Vector Models and Indexes

This category has diverse data sources. Sources include structured employee contact lists, semi-structured click statistics, and unstructured long-text courseware and short-text email templates. Vector models must support vectorization of multiple text types. Data updates occur infrequently. Real-time indexes are not necessary. Batch offline indexing reduces computing costs. Document lengths vary significantly. Long courseware requires proper splitting to preserve semantic integrity. Short templates require avoiding excessive splitting that causes semantic breaks. Association fields between drill result reports, personnel, and scenarios must be retained in indexes. This allows tracing specific information during later reviews.

How to Set Configurations

Configuration ItemRecommended ValueRationale
Chunk Length800–1200 charactersFits splitting long texts such as training courseware and drill plans, avoids semantic breaks, and matches the default chunking logic of FastGPT v4.17.0
Overlap Length100–150 charactersPreserves semantic connections between chunks, meets context continuity needs for short texts such as phishing email templates
maxToken8192 tokenAdapts to the input length limits of mainstream embedding models, accommodates single-chunk content after long document splitting, and complies with parameter requirements of FastGPT v4.17.0
defaultTokenCalibrated via actual testingAdapts to default token counting rules of different embedding models, avoids format errors during model calls
Similarity Threshold0.72–0.85Balances retrieval recall rate and precision, fits key information retrieval needs for drill result reports
Single Search LimitTop 10 entriesControls the volume of returned search results, avoids redundant information interfering with drill review processes

Three Common Misconfigurations

  • Issue: After replacing the embedding model, existing knowledge base search results have obvious deviations, or return a "model mismatch" prompt. Cause: Index rebuilding was not performed. Existing vector data was generated based on the old model, and does not match the vector space of the new model.
  • Issue: Calling the embedding API returns an "undefined model must match "^(text" error. Cause: The name format of the selected embedding model was not configured correctly, or API call permissions for the corresponding model were not enabled.
  • Issue: Knowledge base search results are sorted differently than expected based on semantic similarity. Low-relevance content appears first. Cause: Reranking was not configured. Only the original sorting logic of basic vector recall was used, and no weight adjustments were made based on drill scenarios.

How to Confirm Configurations Are Correct

  • The embedding test API is called to generate vector values for a single phishing email template. The output format is verified to match the selected model, confirming the model configuration is correct.
  • A batch index rebuilding operation is performed. No errors are confirmed, and indexing progress completes normally, confirming index configuration and data processing logic match.
  • A single drill result report is imported. Keywords such as "drill audience" and "unauthorized click" are searched. Returned results are verified to align with expected semantic relevance in terms of sorting.
  • The index chunk statistics panel is viewed. Chunk length and overlap length are confirmed to match preset values, verifying chunking rules are active.

The values provided here are common starting points. They should be validated against the reader’s own samples.

Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.