What this type of data looks like
Core data for vulnerability scanning services comes from vulnerability scanners, enterprise asset inventories, public CVE databases, and official patch announcements. Daily produced documents include scanning plans, vulnerability lists, remediation work orders, and rescan reports. Each document contains fixed fields such as vulnerability ID, associated asset IP, scan execution time, risk level, and patch status. Data update cycles run weekly or monthly. Results of a single scan task are updated synchronously with the rescan process. Scan results for different assets are categorized and archived by scan batch.
What constraints do these characteristics impose on citation sources and traceability processes
Mixed use of multi-source data requires traceability processes to clearly distinguish original data from vulnerability scanners, standard CVE database information, and different citation formats of patch announcements. This avoids confusion between field definitions from different sources. Fixed-cycle update rhythms require matching data update timestamps during traceability. This ensures cited vulnerability information aligns with the latest current scan results. Fixed field structures require citations to carry unique identifiers such as vulnerability ID and asset IP. This allows quick location of original documents. Additionally, the high time cost of false positive elimination and rescan verification requires traceability to directly link to rescan reports and remediation work orders. This reduces manual verification costs.
How to configure settings
These configurations apply to FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average length of a single vulnerability scan description, to avoid truncating critical traceability information |
responseData | Return only associated knowledge base data | Ensures output content only comes from vulnerability scan-related documents, excluding irrelevant general content |
detail | Enabled | Displays specific fields of the citation source, such as vulnerability ID, scan execution time, and asset IP |
| Single search limit | Top 3 entries | Matches the number of associated vulnerabilities per scan plan, to avoid redundant citations |
| Question optimization | Disabled | Prevents the model from rewriting original scan data, preserving original fields and formats required for traceability |
| Maximum context | 10000 characters | Accommodates complete content of multiple scan reports, CVE database entries, and patch announcements |
Three common configuration errors
- Phenomenon: Returned content is not associated with vulnerability scan data in the knowledge base, only generating general vulnerability descriptions. Cause: The
responseDataonly associated data switch is not enabled, or the configured maximum context length is insufficient to accommodate scan report content. - Phenomenon: Citation sources only display document types, without specific vulnerability ID or asset IP information. Cause: The
detailconfiguration item is not enabled, or the field mapping rule for vulnerability data is not configured in the knowledge base. - Phenomenon: Number of citations exceeds expectations, leading to log redundancy and reduced traceability efficiency. Cause: The single search limit is configured too high, not matching the actual number of associated vulnerabilities per scan plan.
How to confirm configuration validity
- Initiate a query for a known vulnerability ID, verify returned content includes knowledge base fields such as the vulnerability’s CVE number and scan time.
- Review system logs to confirm citation source document types are scan plans, vulnerability lists, or rescan reports, with no irrelevant data sources.
- Adjust the
quoteMaxTokenconfiguration to a smaller value, verify long vulnerability descriptions are truncated, and confirm configuration takes effect. - Test disabling the
detailconfiguration, confirm detailed citation source fields are no longer displayed, and verify configuration takes effect.
The values provided are common starting points and should be measured against local deployment samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.