What this category of data looks like
This category of data centers on baseline checklists, configuration verification records, rectification suggestions, and exception approval documents routinely produced by security operations and internal audit personnel. Data sources cover server configurations, middleware configurations, security device policies, and dedicated baseline tools. The data update cycle is monthly or quarterly. Each entry typically includes fields such as configuration item name, compliance status, verification time, and exception description. There are no unified fixed units, and content must be matched in line with specific security baseline requirements.
What constraints do these characteristics impose on the "knowledge base retrieval and recall" link?
Data sources are scattered, with both structured configuration items and unstructured approval texts. Simultaneous support is required for precise matching of configuration fields and fuzzy matching of rectification suggestion content. The update cycle is long, so the knowledge base does not need frequent incremental synchronization, but must support full refresh on a periodic basis. Data fields are dynamically adjusted along with security baselines, so retrieval must adapt to changing configuration item rules. Exception approval documents have a high proportion of unstructured content, so the weight of precise recall and fuzzy matching must be balanced to avoid missing relevant verification records in exception scenarios. At the same time, different retrieval requirements for configuration item verification and rectification result review must be distinguished to avoid mixing results from the two scenarios. The FastGPT v4.17.0 retrieval framework can adapt to the retrieval constraints of this type of mixed data.
How to configure settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Meets the precise matching requirements of security baseline configuration items, avoids irrelevant configurations being included due to too low a threshold, and avoids missing compliant configurations due to too high a threshold |
limit | Top 10 entries | Balances retrieval efficiency and coverage. The number of configuration items for security baseline verification typically ranges in the dozens, so 10 entries can cover core verification items |
searchMode | vector | Adapts to semantic matching requirements for mixed retrieval of structured configuration fields and unstructured rectification texts using vector mode |
usingReRank | Enabled | Performs secondary sorting on retrieval results, optimizes recall sorting for unstructured content such as exception approval documents, and improves the accuracy of rectification suggestion matching |
collectionIds | Pass the target baseline knowledge base collection ID | Limits the retrieval scope, avoids recalling redundant data across baselines, and ensures retrieval results only target the currently executed security baseline check |
datasetSearchUsingExtensionQuery | Disabled | The rules for security baseline data are relatively fixed, no additional query word expansion is required, to avoid introducing irrelevant retrieval results |
Three common misconfigurations
- Phenomenon: A large number of configuration items irrelevant to the current baseline benchmark appear in retrieval results. Cause: No reasonable
similaritythreshold is set, or thecollectionIdsparameter is not specified to limit the target knowledge base collection, resulting in the recall of redundant data across baselines. - Phenomenon: Structured indexes cannot be generated after calling the interface, or retrieval results do not include rectification suggestion content. Cause: The functional boundaries between "add data to collection" and "create training order" are confused. Adding data to a collection only completes text upload, while creating a training order triggers the structured index construction process for baseline data. The corresponding interface must be selected based on the scenario.
- Phenomenon: The order of returned configuration items does not match the verification priority, and high-priority rectification items are not prioritized. Cause: The
usingReRankreordering function is not enabled, and only the sorting results of initial vector recall are relied upon, which cannot adapt to the semantic priority of rectification suggestions.
How to verify successful configuration
- Upload a test baseline checklist, perform a retrieval query, and check whether the returned results include matching configuration item names and compliance status.
- Call the specified interface with the
collectionIdsparameter, and confirm that retrieval results only come from the target security baseline knowledge base collection. - After enabling
usingReRank, compare the rectification suggestion sorting results before and after reordering to confirm that high-priority rectification items are prioritized. - Adjust the
similaritythreshold, and verify whether the number of redundant retrieval results changes as expected.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.