What the data for this category looks like
Data for this category comes from SIEM, EDR, NDR, and threat intelligence sources. Update cycles fall into two categories: real-time and daily. Regularly produced documents include alarm handling sheets, duty logs, threat intelligence reports, daily and weekly reports. Data fields include unique alarm identifiers, handling status, associated threat intelligence IDs, duty staff identifiers, and handling duration. All data is generated around the alarm analysis and upgrade handling workflow.
What constraints these characteristics impose on deployment and upgrades
Due to multiple data sources and real-time updates, interface permissions for multiple data source types must be configured during deployment to avoid data synchronization interruptions. Daily threat intelligence reports and weekly report data require stable structured storage. Configure MONGODB_URI and PG_URL to store unstructured and structured data respectively. Concurrent queries for real-time alarms consume a large number of database connections. Set DB_MAX_LINK appropriately to avoid connection pool exhaustion. During upgrades, ensure real-time alarm caching is not interrupted. Use REDIS_URL to set up a temporary cache layer to prevent loss of alarm data during upgrades. FastGPT v4.17.0 includes optimizations for multi-data source adaptation in SOC scenarios. Strictly follow version configuration requirements.
How to Set Configurations
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
DB_MAX_LINK | 100–200 | Adapts to the concurrent query demands of real-time alarms in SOC scenarios, prevents database connection pool exhaustion |
MONGODB_URI | Actual MongoDB cluster connection address for deployment, with authentication parameters | Stores unstructured document data such as historical alarm handling sheets and duty logs |
REDIS_URL | Local Redis service address, default port 6379 | Caches real-time alarm data to reduce repeated query pressure on data sources such as SIEM and EDR |
FILE_TOKEN_KEY | 32-bit randomly generated string | Encrypts and stores attachment files related to alarm handling, prevents sensitive information leaks |
PG_URL | Enterprise internal PostgreSQL database connection address | Stores structured alarm fields and handling process data |
FE_DOMAIN | Deployed frontend access domain name | Configures callback addresses for alarm push and frontend page access paths |
Three Common Misconfigurations
- Symptom: When creating a knowledge base, the locally deployed ChatGLM2 model cannot be selected, and the model list in the interface is empty. Cause:
MONGODB_URIis not correctly configured to store model access configurations, orREDIS_URLis not used to cache model running status, causing the system to fail to recognize the deployed local model. - Symptom: A startup error occurs during Sealos simple application deployment. The container log shows a database connection failure. Cause: Access permission configurations for
PG_URLorMONGODB_URIare not correctly filled in, or external access permissions for database ports are not opened. - Symptom: CosyVoice2-0.5B cannot be used normally, while whisper-large-v3-turbo runs normally. Cause:
STORAGE_S3_ENDPOINTis not configured to store temporary files generated by the speech model, or the FastGPT version does not meet the v4.17.0 adaptation requirements for the model.
How to Verify Successful Configuration
- Access the configured
FE_DOMAINand navigate to the model access page in system settings. Confirm that the deployed local model appears in the optional list. - Perform a database connection test. Input the configured
DB_MAX_LINKvalue, initiate concurrent query requests of the corresponding quantity. Confirm that no connection timeout or rejection errors occur. - Upload an alarm handling sheet attachment. Verify that the file storage path is generated normally, with no permission or format errors.
- Trigger a simulated real-time alarm. Confirm that the data cached via
REDIS_URLis displayed normally in the system's alarm list.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.