What the data for this category looks like
The data for this category primarily comes from WAF, IDS, firewalls, and external threat intelligence platforms. Four types of documents are generated regularly: rule change tickets, intercept logs, false positive analysis reports, and policy rollback records. Data update frequency is mostly daily or triggered by protection events. Document structures include policy ID, effective time, intercept rule details, false positive threshold, business association fields, and other elements. Core identifiers are mostly rule ID, event time, and traffic characteristics. There are no unified fixed units; values adjust based on document type.
What constraints these characteristics impose on knowledge base retrieval and recall
Dispersed data sources that update in real time with protection events require retrieval and recall to support rapid multi-source data integration. Documents contain precise identifiers such as rule ID and event time. This demands field-level retrieval capabilities to locate specific policies. Documents for false positive analysis and rule changes update frequently. This requires incremental recall to avoid loading full volumes of old data. Single-record data volumes for intercept logs and policy rollback records vary widely. This demands adaptation to document chunks of different lengths, while maintaining retrieval accuracy and response speed.
How to set configurations
| Configuration Item | Recommended Value Range | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Documents in this category mostly include precise fields such as rule ID and traffic characteristics. This range filters irrelevant intercept logs and policy records with low matching scores. |
limit | Top 10–15 results | Daily retrieval targets single rules or single false positive scenarios. Loading excessive redundant data is unnecessary. |
searchMode | Hybrid vector search + keyword search | This balances precise matching for structured fields such as rule ID and semantic matching for rule descriptions. |
usingReRank | Enabled, use top 3–5 reranked results | Scenarios such as false positive analysis and rule review need to prioritize highly relevant historical records. Reranking improves result relevance. |
datasetSearchUsingExtensionQuery | Enabled | This automatically supplements threat intelligence context related to rules, optimizing the coverage of retrieval and recall. |
collectionIds | Configured by grouping security product rule bases | This isolates knowledge bases from different WAF/IDS products, preventing cross-product data confusion. |
Three common configuration errors
- Deploying a 70B model causes knowledge base retrieval timeouts. The root cause is failure to set a reasonable retrieval recall limit for large model calls. Too many document fragments are sent to the large model context, leading to excessive processing latency.
- Uploading a 190MB file to the knowledge base triggers the
offset is out of boundserror. The root cause is failure to adjust chunk parameters for large files. The default chunk size cannot accommodate long text passages within a single file, causing offset overflow during indexing. - Knowledge base answer accuracy is low, and it cannot precisely match rule change content. The root cause is failure to enable
datasetSearchUsingExtensionQuery. Not supplementing context information related to rules causes retrieval and recall results to be disconnected from actual business scenarios.
How to confirm configurations are correctly applied
- Confirm the running FastGPT version is v4.17.0. Configuration may fail due to version differences.
- Upload a single rule change ticket and intercept log, then run a retrieval test. Verify that returned result matching meets business expectations.
- Adjust the
similarityparameter range, and verify that irrelevant data with low matching scores is effectively filtered. - After enabling
usingReRank, compare result rankings before and after reranking. Confirm that highly relevant documents are displayed first.
The values provided here are common starting points. They should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.