What data for this category looks like
Service targets for this category include SOC analysts, security operation outsourcing teams, and enterprise security centers. These users regularly process documents including alarm disposal sheets, duty logs, threat intelligence reports, and daily/weekly reports. Core data sources are SIEM, EDR, NDR, and various threat intelligence feeds. Data update cycles fall into two categories: real-time (alarm flow) and daily (weekly reports, intelligence summaries). Document structures include standardized fields such as alarm ID, timestamp, disposal status, and associated source addresses. No additional custom non-standard fields are used.
What constraints these characteristics impose on the "source citation and traceability" link
Mixed calls to multiple data sources require traceability links to cover unique identifiers from different data sources such as SIEM and EDR, to avoid traceability confusion. Real-time updated alarm data requires that the response speed of citation traceability matches analysis and judgment timeliness, with no excessive delay. Standardized document fields require that traceability configurations must bind fixed fields to ensure citation accuracy. Time-consuming alarm analysis links require that traceability configurations can quickly locate associated documents to reduce interference from invalid information. The consequences of errors from missed real attacks and accumulated false positives and false negatives require that traceability links fully cover the entire process of disposal records, with no key nodes omitted.
How to set configurations
| Configuration Item | Recommended Value Range | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average length of single documents such as alarm disposal sheets and threat intelligence reports, to avoid truncating critical traceability identifiers |
responseData | Return only associated data source fields | Corresponds to alarm ID and timestamp fields from sources such as SIEM and EDR, ensuring accurate matching of traceability to specific alarm events |
detail | Enable full traceability link | Associates linked IDs from duty logs, daily/weekly reports, covering all analysis basis from alarm discovery to dispatching |
| Single search limit | Top 5 matching results | Meets the rapid analysis needs of real-time alarms, avoiding interference from redundant information for analysts |
| Context citation trigger rule | Trigger based on alarm level | High-priority alarms force display of traceability information; low-priority alarms can use simplified configurations, calibrated through actual testing |
This document applies to FastGPT v4.17.0.
Three common configuration mistakes
- Setting
quoteMaxTokento less than 600 tokens. This truncates exported alarm disposal sheet documents, leading to missing critical alarm IDs during citation traceability, making it impossible to locate the original alarm. - Failing to synchronize and bind data source mapping configurations after exporting workflow JSON. When imported into other environments, associated SIEM/EDR plugins cannot match corresponding data sources, resulting in plugin not found errors.
- Not configuring conversation permissions after enabling the citation display switch. The end of responses will show "No permission to operate this conversation record", making it impossible to normally hide or display citation information.
How to confirm configurations are correct
- Initiate a simulated high-priority alarm query, verify that the end of the response associates the corresponding SIEM alarm ID and threat intelligence source link.
- Export the workflow configuration JSON from the current environment, import it into a test environment, and check that associated data source plugins load normally.
- Adjust
quoteMaxTokento the recommended range, verify that citation content from long documents is not truncated. - Disable the citation display switch, initiate a conversation, confirm that no permission errors or invalid citation prompts appear at the end of responses.
All recommended configuration values are common starting points, and should be validated against the user's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.