What this category of data looks like
This category of data is aggregated per single security incident. Data sources include SIEM, EDR, firewall logs, and host images. Data updates trigger when incidents occur, supporting real-time updates or updates per incident granularity. Daily associated documents include incident response reports, forensic records, disposal plans, and notification materials. Each document focuses on a specific incident, containing core fields such as incident time, attack path, and disposal actions. The overall data structure adjusts dynamically based on incident complexity, with no unified fixed length limit.
What constraints these data characteristics impose on model access and configuration
These data characteristics create three core constraints for model access and configuration. First, data sources are diverse, with updates occurring in real time or per incident granularity. Configure highly available model call endpoints. This ensures response speed during security disposal workflows. Second, each data set focuses on a single security incident. Input length fluctuates widely. Set parameters adapted to variable contexts. This avoids truncating critical attack path or evidence chain information. Third, core tasks center on attack path restoration and evidence chain organization. Configure corresponding tool call rules. Prioritize tools adapted for log parsing. This improves disposal efficiency.
How to set configurations
This document applies to FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
maxContext | 8000–12000 token | This category of single-incident data has wide fluctuations in input length, covering log snippets and disposal documents. This range adapts to context needs for most incidents |
maxTokens | 2000–3000 token | Outputs for incident response reports and disposal plans need to cover complete steps. This range ensures sufficient output information volume |
quoteMaxToken | 1500 token | Key content from original logs and forensic records must be prioritized for retention, avoiding truncation of core evidence in citations |
toolChoice | auto | Core tasks include log parsing and attack path restoration. Automatic tool calls adapt to multiple data source types |
temperature | 0.2–0.4 | Disposal recommendations must remain consistent, avoiding output fluctuations that impact emergency decision-making |
AIPROXY_API_TOKEN | Set to the administrator token matching the AI Proxy server. Must not be empty | This variable is an App/Admin server environment variable. It is not an application API Key, model vendor key, or request-issued token |
AIPROXY_API_ENDPOINT | Set to the root address of the AI Proxy service, for example http://aiproxy:3000. Configure highly available nodes based on regional proximity. Do not append paths such as /v1 or /chat/completions | Data updates in real time. Low-latency AI Proxy service endpoints ensure response speed during security disposal workflows. This address is not a single-model address such as VLLM/Ollama/Xinference |
Three common configuration errors
- Symptom: After rearranging model configurations, response delay for single security incident analysis exceeds 60 seconds, or call timeout errors occur. Cause: The number of input fragments for the reranked model is not limited for the multi-log data source scenario of this category, leading to excessive processing load.
- Symptom: Configuring
AIPROXY_API_ENDPOINTorAIPROXY_API_TOKENon the FastGPT platform, workflow global variables, application API request headers, or the general model management page. Or repeating AI Proxy-related environment variable configurations in local config.json. This leads to call permission conflicts or duplicate request sending. Troubleshooting step: Confirm thatAIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare App/Admin server environment variables. Do not fill these values in non-server deployment configuration locations. - Symptom: Emergency response suggestions generated based on the knowledge base only include summary content, and do not reference specific disposal clauses or log details. Cause: The
quoteMaxTokenparameter is not adjusted, leading to excessive truncation of citation content from original documents, making complete detailed information unable to be output.
How to verify correct configuration
- Submit a simulated data set for a single security incident. Check the response delay of model outputs. Adjust relevant parameters to match the delay requirements of the business scenario.
- View model call logs. Confirm that
toolChoiceautomatically calls tools adapted for log parsing. No abnormal errors or tool call failures should appear. - Verify that the generated emergency response report includes core snippets from original logs and forensic records. Confirm that citation content is not excessively truncated.
- Check the
AIPROXY_API_ENDPOINTenvironment variable deployed on the server. Confirm that it is the root address of the AI Proxy service, for example http://aiproxy:3000. Do not append paths such as /v1 or /chat/completions. Confirm that it uses a nearby highly available node. No delay issues caused by cross-region calls should exist.
The values provided are common initial settings and should be validated against local operational samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.