What data for this category looks like
Vulnerability scanning services obtain data primarily from vulnerability scanners, asset inventories, CVE databases, and patch announcements. Daily produced documents include scanning plans, vulnerability lists, remediation work orders, and rescan reports. A single document includes fields such as asset IP, vulnerability CVE number, risk level, repair status, and scan time. Update frequency is weekly or monthly. Most data uses structured fields, while some patch announcements are unstructured text that must be cleaned before being added to the knowledge base.
What constraints do these characteristics impose on the "source citation and traceability" link
Vulnerability scanning service data involves high-risk vulnerability information. Citation and traceability processes must ensure sources are traceable and accurate. The weekly or monthly update cycle requires traceability links to associate scan timestamps, preventing citation of expired vulnerability data. Multi-source data requires traceability processes to mark data source types, distinguishing scanner-native data from CVE database supplementary information. For mixed structured fields and unstructured text, traceability processes must clarify field ownership to avoid confusion between asset information and vulnerability details. Additionally, association between remediation work orders and rescan reports requires traceability links to bind the corresponding scanning plan ID, ensuring a complete traceability chain for vulnerability repair status.
How to set configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 900–1100 token | Matches the average length of a single vulnerability detail, to avoid truncating core traceability information such as CVE numbers and repair steps |
responseData | Return complete source data fields | Ensures that original identifiers such as asset IP, scan time, and risk level can be directly extracted during traceability, without secondary splicing |
detail | Enable full details | Retains complete text of patch announcements and rescan reports, meeting traceability verification needs when eliminating false positives |
| Single recall limit | Top 4 entries | Matches the typical number of high-risk vulnerabilities in a single scan for vulnerability scanning services, avoiding excessive redundant information occupying context |
| Maximum context length | 4000–6000 token | Matches the typical knowledge base context requirements for vulnerability scanning services, avoiding context overflow |
| Version compatibility | Compatible with FastGPT v4.17.0 | Follows the traceability configuration logic of this version to ensure parameters take effect |
Three common configuration mistakes
- Phenomenon: After setting
quoteMaxTokento 1500 token, document blocks in the knowledge base that exceed this length are still cited. Cause:quoteMaxTokenonly limits truncation length during citation, and does not filter document blocks exceeding the threshold. It is not paired with document chunking configuration to limit single chunk length. - Phenomenon: Vulnerability data is retrieved from the knowledge base, but no citation information is returned in AI conversations. Cause: The
detailconfiguration item is not enabled, orresponseDatais not configured to return source data fields, causing the system to fail to extract identifier information required for traceability. - Phenomenon: When knowledge base retrieval results are passed to HTTP request processing before being submitted to AI conversations, the citation format is abnormal. Cause: Fields such as asset ID and scan time of the source data are not encapsulated into a recognizable format as required, causing the system to fail to associate traceability information.
How to confirm configuration is valid
- Submit a test query containing high-risk vulnerabilities, check whether returned results include the CVE number and scan time of the source data.
- Adjust
quoteMaxTokento a smaller value, verify whether long document blocks are truncated, confirm configuration takes effect. - Trigger a simulated scanning task, retrieve corresponding vulnerability data, check whether returned results include complete patch announcement details.
- View AI conversation context logs, confirm source data fields have been correctly associated to citation information.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.