What Data for This Category Looks Like
Data sources for this category include SIEM, EDR, firewall logs, and host images. Update frequency is real-time or triggered per single incident. Daily associated documents include emergency response reports, forensic records, disposal plans, and notification materials. Data fields include attack source IP, disposal time, alert level, evidence chain hash value, and others. The length of individual data entries varies widely, ranging from short alert entries to complete forensic mirror files.
Constraints Imposed by These Characteristics on Reranking and Hybrid Retrieval
Data sources are scattered and have significant format differences. Hybrid retrieval must adapt to both structured logs and unstructured documents. It must balance recall weights across different modalities. Real-time update requirements mean the retrieval pipeline must have no extra latency. The reranking step must be lightweight to avoid impacting response timeliness. Single-incident associated data volume fluctuates greatly. The total number of recalled entries per session must be limited to avoid context overload. Field differences across documents require mapping to unified business tags during retrieval. This prevents recalled results from mismatching the emergency response scenario. Core links such as attack path restoration and evidence chain organization rely on accurately associated data. Retrieval relevance directly affects disposal efficiency. Errors may lead to expanded data leaks, business outages, delayed regulatory reports, and other consequences.
How to Configure Settings
The following configurations are explained based on FastGPT v4.17.0.
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
| Search Mode | hybrid | Adapt to multi-source heterogeneous emergency response data recall requirements including SIEM logs and forensic documents |
| Similarity Threshold | 0.72–0.85 | Filter low-relevance alerts and documents to avoid irrelevant content interfering with emergency response judgments |
| Single Recall Cap | Top 15 entries | Control total number of recalled entries per session, adapt to context length limits for attack path restoration |
| Reranking Toggle | Enabled | Rerank recalled results by attack impact weight, prioritize high-priority disposal plans and forensic records |
| Reranking Model Adaptation | arm/amd dual-architecture compatible image | Adapt to hardware architectures of different deployment environments, avoid architecture incompatibility errors |
| Context Window | Calibrated based on actual testing | Match average length of emergency response documents, avoid context overflow |
Three Common Misconfigurations
- Phenomenon: Reranking toggle is set to enabled, but returned results are not reranked by attack priority. The result list order matches the initial recall order. Cause: Reranking model invocation parameters are not configured correctly, or the reranking step trigger logic is not bound to the current retrieval workflow.
- Phenomenon: Container fails to start after deployment. Logs prompt architecture incompatibility. Cause: A reranking model image that only supports amd architecture is used, and the deployment environment’s arm architecture is not adapted.
- Phenomenon: Recall results from hybrid retrieval have lower relevance than single semantic retrieval, and cannot cover log and document association information required for emergency response. Cause: Weight allocation for hybrid retrieval is not adjusted for multi-source data such as SIEM logs and forensic documents, leading to overly high semantic recall proportion.
How to Verify Proper Configuration
- View the recall result list in the retrieval console. Confirm that multi-source data (SIEM logs, forensic documents) are both recalled, and the order matches business priority expectations.
- Check the reranking step’s operation logs. Confirm that the reranking model has been successfully invoked, with no architecture incompatibility or permission errors.
- Adjust the similarity threshold value. Verify that low-relevance alerts are correctly filtered, matching the filtering requirements of the business scenario.
- Switch between different search modes. Compare recall results between hybrid retrieval and single semantic retrieval. Confirm that hybrid mode covers more dimensions of associated data.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.