What the Data for This Category Looks Like
This category of data primarily originates from vulnerability scanners, asset inventories, CVE databases, and patch bulletins. Daily produced documents include scan plans, vulnerability lists, remediation tickets, and rescan reports. Data fields include vulnerability ID, associated asset address, risk level, remediation status, scan time, rescan result, and more. Update frequency is weekly or monthly, with data synced alongside newly disclosed CVE entries, asset changes, or patch releases. The core associated fields are asset identifier and vulnerability ID, used to link end-to-end troubleshooting and retrospective data.
What Constraints These Characteristics Impose on Database and Operations Workflows
Heterogeneous data from multiple sources requires unified field mapping and associated queries. Databases must therefore support flexible field expansion and mixed query capabilities. Weekly and monthly batch scans and updates create peak write pressure. Reasonable connection pool parameters must be configured to avoid connection exhaustion. Storage structure differences across document types require databases to support both unstructured documents and structured relational data storage. Strong associations between assets and vulnerabilities require consistency checks, to prevent troubleshooting deviations caused by incorrect associations. Additionally, data retention periods under audit and compliance requirements must be configurable. Interfaces for data archiving must be reserved in operations workflows.
How to Set Configurations
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
MONGODB_URI | mongodb://user:pass@host:port/scan_db?authSource=admin | Used to store unstructured scan logs and rescan reports; requires specifying the authentication source and target database |
PG_URL | postgresql://user:pass@host:port/scan_db?sslmode=require | Used to store structured relational data such as vulnerability lists and remediation tickets; enables SSL to secure data transmission |
DB_MAX_LINK | 100–150 connections | Matches peak write demands from weekly batch scans, prevents task interruptions caused by connection exhaustion |
REDIS_URL | redis://:pass@host:port/0 | Used to cache temporary status of scan plans and asset cache data, reduces high-frequency query pressure on databases |
| Data Archival Period | 30–365 days | Adapts to audit and data retention compliance requirements, avoids redundant data occupying storage resources |
Three Common Misconfigurations
- Phenomenon: Running the same SQL query for the vulnerability list table sometimes succeeds and sometimes returns no results. Cause: The
DB_MAX_LINKconfiguration value is set too low. Connection exhaustion during peak hours prevents some queries from acquiring valid connections. - Phenomenon: When a tool call node runs a vulnerability data query, tasks stall directly with no error messages displayed. Cause: The
REDIS_URLconfiguration is incorrect. Temporary status for cached scan tasks cannot be synchronized, preventing the node from acquiring execution permissions. - Phenomenon: The mongoose version cannot be viewed using the npm list command in the FastGPT v4.17.0 container environment. Cause: The container image preinstalls the mongoose dependency but does not configure global npm environment variables. This prevents the dependency package from being retrieved via global commands.
How to Verify Proper Configuration
- Execute a batch scan task, monitor database connection count metrics, and confirm that the connection count does not exceed the configured
DB_MAX_LINKlimit. - Repeatedly run the same vulnerability list query SQL, and confirm that expected results are returned stably each time.
- Log in to the FastGPT container environment, view the package.json file, confirm that the mongoose dependency is present, and verify that the configured
MONGODB_URIcan establish a normal connection. - Trigger a rescan task, confirm that task status is normally synchronized to the database and cache, with no abnormal stalls.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.