What this category of data looks like
Data for this category originates from security information and event management (SIEM) systems, endpoint detection and response (EDR) tools, firewall logs, and host images. Updates occur in real time, or are triggered by individual security incidents. Daily generated documents include emergency response reports, forensics records, disposal plans, and notification materials. Each document must link to fields such as incident ID, disposal time, and impact scope. There is no fixed unified format, but the full disposal chain must be retained. Data is only generated for confirmed security incidents. It does not include daily operational content that does not trigger alerts.
What constraints do these characteristics impose on the deployment and upgrade process
These data characteristics impose multiple constraints on the deployment and upgrade process. First, data sources are scattered and updated in real time. During deployment, ensure that access permission configurations for each log source are accurate. Avoid interruptions in data pulling that would affect emergency response timeliness. Second, daily documents must link to fields such as incident ID and disposal time. During upgrades, retain the original incident linking logic. Prevent historical data from failing to match retrieval requests. Third, errors can lead to expanded data leaks or business outages. During the deployment phase, verify the reliability of the data link. Before upgrading, back up application configurations and historical ticket data related to emergency responses.
How to set configurations
| Configuration Item | Recommended Value | Rationale for This Value |
|---|---|---|
DB_MAX_LINK | 100–200 | Data for this category is generated in real time and has scattered sources. A sufficient database connection pool is required to support concurrent pulling of log and ticket data |
MONGODB_URI | mongodb://[username]:[password]@[host]:[port]/fastgpt_siem | Unstructured data such as emergency response reports and forensics records must be stored. MongoDB is used to adapt to document-type storage requirements |
REDIS_URL | redis://:[password]@[host]:[port]/0 | Used to cache real-time alerts and ticket statuses, reducing resource consumption from repeated log pulling. The value must match the Redis instance deployed in the internal network |
STORAGE_S3_ENDPOINT | Configured according to the local object storage address | Used to store large-volume data such as host images and forensics files. It must adapt to the enterprise's internal object storage service |
ROOT_KEY | Generate a random string according to enterprise security policies | Used for administrator permission verification. It must comply with permission control requirements in security incident emergency response scenarios |
Three common mistakes
- Symptom: All existing security incident emergency response applications fail to load after upgrading from an older version. Cause: The database backup associated with
PG_URLwas not backed up and restored during the upgrade process, resulting in loss of ticket and application configuration data. - Symptom: Security log retrieval calls return empty results. Cause:
STORAGE_S3_ENDPOINTwas not configured correctly, preventing normal linked retrieval of forensics files and log sources. - Symptom: The tool invocation panel for operations on-duty accounts does not show the code run option. Cause: The administrator permission configuration corresponding to
ROOT_KEYwas not enabled, preventing advanced tool functions from being available to operations on-duty accounts.
How to confirm configurations are set correctly
- Log in to the FastGPT backend, view the
MONGODB_URIconfiguration item, and verify that it can connect normally and read collection data related to emergency responses. - Submit a simulated security incident ticket, and check that it can flow normally and link to the corresponding log source data.
- View the monitoring metrics for
REDIS_URL, and confirm that the cache connection count is within a normal fluctuation range. - In FastGPT v4.17.0, log in with an operations on-duty account, and check that the tool invocation panel includes advanced function options such as code run.
The values given are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.