What the Data for This Category Looks Like
Typical data for this category comes from SIEM, EDR, NDR, and threat intelligence sources. Update cycles fall into two categories: real-time and daily. Daily processed documents include alarm disposal sheets, duty logs, threat intelligence bulletins, and daily and weekly reports. Alarm disposal sheets include fields such as alarm time, disposal status, and associated threat ID. Duty logs include duty periods, alarm summaries, and disposal progress. Threat intelligence bulletins include threat type, IOC value, and bulletin timeliness. The data structure includes both structured fields and unstructured text content.
Constraints on Knowledge Base Retrieval and Recall
These characteristics create specific constraints for the knowledge base retrieval and recall workflow: Real-time alarm data updates require the retrieval link to support near-real-time dataset synchronization, preventing recall of outdated disposal information. Multi-source heterogeneous data requires retrieval to match cross-format document content across fields, covering all dimensions linked to alarms. The time-consuming alarm analysis and false positive elimination process requires precise, limited recall results, reducing analysts’ screening costs. High-frequency data updates require retrieval configurations to adapt to frequently added threat intelligence and disposal records, avoiding lagging recall results. Severe error consequences require retrieval matching thresholds and sorting logic to effectively reduce missed report and false positive rates.
Configuration Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Matching similarity threshold between alarm features in SOC alarm scenarios and threat intelligence, disposal documents, balancing the ratio of missed reports and false positives |
limit | Top 10 entries | Controls the number of single-recall results, adapting to the work rhythm of analysts quickly browsing alarm-related information |
searchMode | Full-text search | Adapts to cross-field matching requirements for multi-source heterogeneous documents, covering structured alarm fields and unstructured bulletin content |
usingReRank | Enabled | Performs secondary sorting on initial recall results, improving the display priority of highly relevant threat intelligence and disposal solutions |
datasetSearchUsingExtensionQuery | Enabled | Generates extended queries based on original alarm questions, covering more associated alarm disposal documents and historical records |
collectionIds | Dataset IDs grouped by alarm type | Targeted retrieval of knowledge bases in corresponding categories, reducing interference from irrelevant content and improving retrieval accuracy |
Three Common Configuration Mistakes
- Phenomenon: When uploading a 3MB PDF-format threat intelligence bulletin, the interface returns a text understanding failure error. Cause: Chunking parameters were not adjusted for long documents in SOC scenarios, resulting in post-chunking text length exceeding the context limit of the default embedding model in FastGPT v4.17.0.
- Phenomenon: Unable to upload Excel-format duty logs or alarm disposal sheets. Cause: The structured file parsing function of FastGPT was not enabled, and only basic formats such as plain text and PDF are supported for document import by default.
- Phenomenon: After configuring a problem classification workflow, the AI dialogue automatically repeats triggering the classification node after returning results. Cause: No branch termination condition was set in the workflow, causing the classification logic loop to not exit after the dialogue result is returned.
How to Verify Successful Configuration
- Upload typical documents of this category (alarm disposal sheets, threat intelligence bulletins), and check if parsed text fields fully match the core content of the original documents.
- Input typical alarm questions, and verify that the number of recall results matches the configuration of the
limitparameter, and that result relevance meets business scenario requirements. - After enabling
usingReRank, confirm that highly relevant threat intelligence results appear at the top of the recall list. - Configure
collectionIdsto perform targeted retrieval of grouped datasets, and check that recall results only come from knowledge bases of specified categories with no irrelevant content included.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.