This document is written based on FastGPT v4.17.0.
What Data for This Category Looks Like
Data for this category originates from SIEM, EDR, firewall logs and host images. Update frequency is real-time or per-event trigger. Daily produced documents include incident response reports, forensic records, disposal plans and notification materials. Data fields include attack path nodes, isolation operation records, evidence chain hash values, regulatory notification numbers and more. Units include timestamps, byte counts, event IDs and more. No mandatory additional statistical requirements apply.
What Constraints These Characteristics Impose on Deployment and Upgrade
This category has diverse data sources and flexible update rhythms. The deployment and upgrade phase must adapt to persistent storage requirements for multi-source log access, and avoid real-time data loss. Single-event data volume fluctuates widely, so elastic storage capacity must be reserved to support time-consuming processes such as attack path restoration and evidence chain organization. Documents include structured fields and unstructured forensic content, so mixed format storage and retrieval must be supported. Encrypted storage and access permission controls must also be configured to prevent data tampering or leakage, and avoid consequences such as expanded data leaks and business outages.
How to Configure Settings
| Configuration Item | Suggested Value | Rationale |
|---|---|---|
DB_MAX_LINK | 200–300 connections | Adapt to concurrent access demands of multi-source logs, avoid database connection pool exhaustion |
MONGODB_URI | Replica set or sharded cluster connection address | Store unstructured forensic content and time-series logs, cluster deployment ensures high availability |
REDIS_URL | Cluster cache address with 600-second timeout | Cache real-time alerts and temporary forensic data, reduce query pressure on relational databases |
STORAGE_S3_ENDPOINT | Compliant domestic object storage endpoint | Store unalterable log copies and evidence materials, ensure data integrity |
FILE_TOKEN_KEY | 32-character random string | Encrypt access tokens for forensic files, prevent unauthorized access to forensic content |
ROOT_KEY | Strong password of at least 16 characters | Configure platform super administrator permissions, ensure security of background operations |
Three Common Misconfigurations
- Running
docker-compose upresults in aconnection refusederror. The cause is incorrect configuration ofMONGODB_URIorREDIS_URL, leading to failure to connect to dependent services properly. - No connected models appear in the platform. The cause is only modifying the model access address configuration item without synchronously updating the associated model key configuration, or not restarting the service to apply new configurations.
- Uploading forensic files prompts insufficient storage permissions. The cause is not configuring the storage bucket access key and read-write permissions corresponding to
STORAGE_S3_ENDPOINT, resulting in rejected storage access.
How to Confirm Configuration Is Complete
- Run the
docker pscommand, confirm all FastGPT dependent services and main containers are in running state. - Access the configured
FE_DOMAINaddress, log in to the platform backend to check whether storage, database and other configuration items match the preset values. - Upload a small test forensic file, confirm the file can be stored normally and retrieved and viewed within the platform.
- Initiate a simulated emergency event query, confirm multi-source log data can be loaded normally and display attack path related content.
The values provided are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.