What data looks like for this category
Data for this category primarily comes from SIEM, EDR, NDR, and various threat intelligence sources. Update cycles include real-time and daily updates. Daily processed documents include alarm disposal tickets, on-duty logs, threat intelligence reports, and daily and weekly reports. Single alarm data includes structured fields such as alarm level, source IP, target asset, trigger time, and disposal status. On-duty logs include content like on-duty periods, disposal actions, and transfer records. Threat intelligence reports contain unstructured text such as IOC characteristics and associated events. Daily and weekly reports integrate multi-day alarm statistics and disposal results.
Constraints for Model Integration and Configuration
Real-time updated alarm data requires model integration to support low-latency calls. This avoids delaying investigation windows. Multi-source heterogeneous data includes structured alarm fields and unstructured intelligence text. Configuration must adapt to mixed-format input parsing to ensure correct processing of all data types. Daily update requirements for batch documents such as daily and weekly reports require models to support batch task scheduling and context reuse. This improves batch analysis efficiency. Daily SOC analyst disposal workflows require models to output structured results matching existing document fields. This avoids additional format conversion costs. High-frequency operations such as false positive elimination and escalation dispatching require configured response speeds to match real-time investigation time requirements.
How to Set Configurations
The following configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Range | Rationale |
|---|---|---|
maxContext | 8000–12000 token | Adapts to the context length of multi-source text such as alarms and intelligence reports, avoiding truncation of critical alarm levels and IOC characteristics |
maxTokens | 2000–3000 token | Matches single-round output requirements for alarm investigation and false positive elimination, ensuring complete structured disposal suggestions |
quoteMaxToken | 1000 characters | Limits the length of referenced source data, avoiding redundant raw alarm content in outputs and focusing on disposal logic |
temperature | 0.3–0.5 | Reduces output randomness, ensuring consistency of alarm investigation results and meeting standardized disposal requirements for SOC on-duty operations |
AIPROXY_API_ENDPOINT | Enter the root address of the AI Proxy service, for example http://aiproxy:3000. Do not append paths such as /v1 or /chat/completions | Ensures FastGPT correctly routes requests to the AI Proxy service, avoiding connection failures |
AIPROXY_API_TOKEN | Enter the administrator token consistent with the AI Proxy service-side configuration, and the value cannot be empty | Completes identity verification between FastGPT and the AI Proxy service, ensuring requests are properly accepted by the AI Proxy service |
Three Common Configuration Mistakes
- Model calls return 400 errors with parameter format exception prompts. Troubleshooting steps: Check if
AIPROXY_API_ENDPOINTandAIPROXY_API_TOKENare correctly configured per requirements, or if FastGPT service startup verification has not been completed. - The model list does not update after modifying config.json. Causes include: FastGPT container was not restarted to load the new configuration, or the configuration file path was entered incorrectly and does not point to the /app/data/config directory.
- Model stream responses are empty with no valid output. Causes include:
maxContextis set too small, leading to truncation of critical alarm context and preventing the model from generating valid investigation results, ortemperatureis set too high, leading to outputs that do not meet format requirements.
How to Confirm Configurations Are Properly Set
- Call the test interface with single alarm data. Check if the returned result contains structured content matching the fields of alarm disposal tickets.
- View the FastGPT backend model list. Confirm that the target model has been properly loaded and displayed.
- Enable stream response debug mode. Observe if segmented investigation results are output, with no empty packets or interruptions.
- Pass batch daily and weekly report samples. Check if model outputs meet the statistical and analysis format requirements for daily updated documents.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.