What the data for this category looks like
In FastGPT v4.17.0, data for this category primarily comes from scan plans, vulnerability lists, rescan reports produced by vulnerability scanners, as well as asset lists, CVE databases, and official patch announcements. Documents include structured fields such as scan scope configuration, vulnerability IDs, risk levels, remediation steps, and rescan results. The update frequency is weekly or monthly. Data follows the asset vulnerability lifecycle, with core fields including asset IP, CVE ID, risk score, and remediation status. No custom statistical units are used.
What constraints this category's characteristics impose on knowledge base retrieval and recall
Data sources for this category are scattered. Integration of multi-source documents from scanners, CVE databases, and other sources is required. The recall link must support cross-source association matching of core fields. Update frequency is fixed at weekly or monthly. Incremental recall logic adapted to the cycle must be configured to avoid duplicate recall of expired data. Document structure revolves around the vulnerability lifecycle. Accurate matching of the association relationships between assets, vulnerabilities, and remediation actions is required to reduce invalid recall results. False positive elimination and rescan verification are core time-consuming steps. Retrieval results must quickly locate historical remediation records for corresponding vulnerabilities. Low-confidence results must also be filtered to prevent returning incorrect solutions that expose high-risk vulnerabilities.
Configuration Settings
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Vulnerability scanning services require accurate matching of core fields such as CVE IDs and asset IPs. A threshold that is too low introduces irrelevant vulnerability documents, while a threshold that is too high may miss historical remediation records. |
limit | Top 8 entries | The number of scan plans and remediation tickets associated with a single vulnerability is limited. Limiting returned entries avoids overly long context while covering core associated data. |
usingReRank | Enabled | The false positive elimination process requires screening highly relevant results. Reranking filters low-confidence non-target vulnerability documents. |
datasetSearchUsingExtensionQuery | Enabled | Extended information from asset lists and CVE databases is automatically associated, supplementing patch announcement source data for vulnerabilities. |
collectionIds | Specify corresponding knowledge base collections by business scenario | Only documents exclusive to the vulnerability scanning service, such as scan plans and remediation tickets, are recalled. This avoids mixing irrelevant data from other categories. |
Three Common Misconfigurations
- Symptom: After configuring the knowledge base, calling the interface returns a 418 status code. The function operates normally when no knowledge base is configured. Cause: The
collectionIdsparameter is not configured correctly, or the associated knowledge base collection does not have access permissions for the current interface. - Symptom: After importing WeChat Official Account articles into the knowledge base, retrieval fails to match content related to corresponding vulnerabilities. Cause: WeChat Official Account articles do not extract structured vulnerability fields, making precise association with retrieval keywords impossible.
- Symptom: The number of returned retrieval results exceeds expectations, or contains a large number of non-target vulnerability documents. Cause: The
similaritythreshold is set too low, failing to filter out low-relevance non-target scan records or remediation tickets.
How to Confirm Proper Configuration
- Call the interface with a test asset IP or CVE ID, and check if returned results include documents such as scan plans and remediation tickets for the corresponding vulnerability.
- View the knowledge base collection association configuration, and confirm that the
collectionIdsparameter points to collections containing vulnerability scanning-related documents required for the current business. - Adjust the
similaritythreshold, verify that the relevance of returned results meets business requirements, and confirm that there are neither too many irrelevant results nor too few valid results. - After enabling
usingReRank, compare retrieval results before and after enabling to confirm that the reranking function correctly filters low-relevance documents.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.