What the data for this category looks like
This category of data comes from SIEM, EDR, NDR, and threat intelligence sources, with update frequencies of real-time or daily. Documents produced and processed daily include alarm disposal sheets, duty logs, threat intelligence notifications, daily and weekly reports. Core fields include alarm ID, associated asset IP, threat level, disposal status, and response duration. Data users are SOC analysts, security operation outsourcing teams, and enterprise security centers. They conduct analysis and duty work based on real-time alarms and periodic reports.
What constraints these characteristics impose on the "workflow orchestration" link
Real-time alarms and multi-source data access require workflows to support low-latency triggering, to avoid alarm backlogs that cause response timeouts. Format differences across data sources require workflows to be configured with unified data parsing nodes to align core fields such as alarm ID and threat level. Daily-updated threat intelligence notifications, daily and weekly reports require workflows to support scheduled triggering and batch generation nodes. Multi-step processes for alarm analysis and false positive elimination require splitting into independent nodes, with manual review links reserved, to adapt to the duty scheduling rhythm of SOC teams.
How to set the configurations
The following configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Scheduled Trigger Interval | 600 seconds to 3600 seconds | Adapts to the polling rhythm of real-time alarm analysis, avoids excessive latency |
| Question Optimization | Calibrated based on actual testing | Optimizes the wording of original alarm text, improves model understanding accuracy for security scenarios |
variables | Pre-set alarm ID, associated asset, threat level variables | Passes core business fields to subsequent workflow nodes, enables data linkage |
| Post-Tool Call Processing | Enable custom code nodes | Processes unstable results returned by tool calls, extracts specific fields or formats output |
nodeId | Assign a unique identifier to each workflow node | Facilitates tracking workflow execution status and locating abnormal links |
| Single Tool Call Limit | Top 5 entries | Limits the number of alarms returned per call, avoids exceeding model context limits |
Three common mistakes
- After enabling question optimization for the knowledge base plugin, closing this configuration in a workflow node still results in the configuration taking effect, and the workflow cannot be called normally. Cause: The global setting for question optimization and workflow node configuration are not isolated, causing in-node settings to be overwritten by global parameters.
- After embedding in a business system, it is impossible to associate business user identities. Cause: User identification parameters are not carried when initiating workflow HTTP requests, and no pre-node for identity verification is configured.
- The number of results returned by tool call nodes is unstable. Cause: No retry mechanism and result verification nodes for tool calls are configured, relying solely on the results of a single tool call.
How to confirm the configuration is complete
- Manually trigger the workflow, check whether core variables are correctly passed to subsequent nodes, and confirm that the fields configured in
variablesare displayed normally. - Test the tool call node, check whether the returned results have been processed by custom code, and verify that the post-processing logic takes effect.
- Simulate an abnormal trigger scenario, check whether the workflow tracks execution logs according to the
nodeIdidentifier, and locate abnormal links. - Initiate a request after embedding in a business system, confirm that user identity parameters are correctly carried, and the workflow can start normally.
The values provided here are common starting points, and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.