What this category of data looks like
This category of data primarily comes from WAF, IDS, firewalls, and threat intelligence platforms, with an update frequency of daily or triggered by security events. Daily generated documents include rule change tickets, intercept logs, false positive analysis reports, and policy rollback records. Fields cover rule unique identifier, intercept timestamp, false positive trigger conditions, policy version number, etc. There are no uniform fixed units, and they adjust according to the business attributes of individual records.
Constraints for Citation Sources and Traceability
This category of data has scattered sources linked to multiple security device types. Citation traceability requires binding device identifiers and rule unique IDs to avoid confusion. Data updates occur daily or when security events are triggered, so support for real-time pulling of latest policies and logs as citation sources is needed. Daily document structures are non-standard, so original fields must be fully retained as traceability basis without unauthorized deletion. False positive analysis and policy rollback records must link to specific rule versions to enable traceability back to operation nodes. This creates clear requirements for recall accuracy and traceability chain integrity.
How to Configure Settings
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Adapts to the average length of single documents such as intercept logs and rule change tickets, avoiding exceeding context limits |
responseData | Retain all original fields | Fully return core information required for traceability, including device identifiers, rule IDs, intercept times, and other details |
detail | Enable full display | Show details such as associated false positive analysis and policy rollback records to meet operational review needs |
| Single search limit | Top 3–5 entries | Matches the number of false positive samples associated with a single rule, avoiding redundant recall of intercept logs |
| Real-time data source switch | Pull daily or event-triggered | Adapts to the update frequency of this category of data, ensuring citation sources are the latest policies and logs |
| Traceability association rule | Bind rule unique identifier | Ensure each citation source is linked to a specific security rule, avoiding traceability confusion |
Three Common Misconfigurations
- Phenomenon: The generated response does not display the source of cited documents, and core fields are empty. Cause: The
detailconfiguration item is not enabled, orresponseDatais not set to retain original fields, resulting in loss of traceability-required information such as device identifiers and rule IDs. - Phenomenon: The token count of the generated response exceeds the set limit, triggering content truncation. Cause: The value of
quoteMaxTokenis too high, and the total length of multiple recalled documents exceeds the FastGPT context limit, while the single search limit is not reasonably controlled. - Phenomenon: The number of cited documents far exceeds expectations, reaching dozens of entries. Cause: The single search limit is set too large, not matching the number of false positive samples associated with a single rule, leading to recall of excessive irrelevant historical intercept logs.
How to Verify Configuration Completion
- Enter the knowledge base configuration page of FastGPT v4.17.0, check whether the value of
quoteMaxTokenfalls within the 800–1200 token range. - Initiate a test query for rule false positive analysis, confirm whether the citation source area of the returned result includes original fields such as device identifiers, rule IDs, and intercept times.
- View the display details of the citation source, verify whether supplementary information such as associated false positive analysis and policy rollback records is shown.
- Adjust the single search limit to top 3 entries, initiate a test query, and count whether the number of returned cited documents matches the associated sample scale of a single rule.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.