This documentation is based on FastGPT v4.17.0.
What This Category of Data Looks Like
Data for this category primarily comes from SIEM, EDR, NDR, and threat intelligence sources. Daily documents include alarm disposal sheets, on-duty records, threat intelligence bulletins, and daily/weekly reports. Data updates follow two cadences: real-time and daily. Real-time alarm data is generated synchronously by security devices. Periodic documents such as daily and weekly reports are updated each calendar day. Alarm disposal sheets include fields for alarm trigger time, source IP, disposal process, and false positive marking. On-duty records include fields for duty shifts and alarm processing progress. Threat intelligence bulletins include IOC values and threat type fields, with no additional custom unit fields.
Constraints on Knowledge Base Retrieval and Recall
This category of data has high heterogeneity. It includes structured device logs, semi-structured ticket documents, and unstructured intelligence bulletins. This requires the retrieval link to support matching logic for multi-format content. Real-time updated alarm data requires the recall link to support near-real-time synchronization. This avoids alarm judgment deviations caused by data lag. Document fields focus on operation and maintenance related content: alarm ID, threat level, disposal steps, and similar items. Retrieval must prioritize matching disposal rules strongly related to the current alarm. It must also control recall latency to prevent impacts on on-call response efficiency. False positive exclusion and escalation dispatching rely on accurate recall results. Insufficient relevance of recall results will directly increase false positive accumulation or lead to missed real attacks.
How to Configure Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Filter low-correlation alarm records to avoid false positives interfering with judgment processes |
limit | Top 8–12 entries | Align with the single analysis window of SOC analysts, reducing the volume of invalid information to review |
searchMode | Hybrid retrieval | Balance keyword matching for structured device logs and semantic association for unstructured intelligence |
usingReRank | Enabled | Improve the ranking priority of high-correlation disposal documents, optimizing analysis efficiency |
datasetSearchUsingExtensionQuery | Enabled | Cover industry-specific terminology and custom abbreviations, improving retrieval matching accuracy for alarm descriptions |
collectionIds | Configured in groups by SIEM, EDR, and threat intelligence sources | Limit retrieval scope, excluding document interference from unrelated data sources |
Three Common Misconfigurations
- A "database connection timeout" error may appear during retrieval. This happens when the
limitparameter is not adjusted for real-time alarm data. Too many recalled documents cause the retrieval link to time out. - Retrieval results may include a large number of non-alarm documents. This happens when
collectionIdsis not configured to limit retrieval collections, leading to recall of documents from cross-business data sources. - Returned disposal steps may not match the current alarm type. This happens when
datasetSearchUsingExtensionQueryis not enabled, so industry terminology and custom abbreviations in alarm descriptions are not covered.
How to Confirm Successful Configuration
- Import a single standard alarm test data set, run a retrieval, and check the relevance of returned results. Adjust the
similarityparameter until it meets analysis requirements. - View retrieval logs, and confirm that all recalled documents come from preset data sources such as SIEM and EDR. This verifies that the
collectionIdsconfiguration takes effect. - Simulate high-frequency retrieval requests, and check whether retrieval latency meets on-call response time requirements. Adjust the
limitparameter to control the number of returned entries. - Input an alarm description containing industry abbreviations, and check whether retrieval results cover relevant documents for the corresponding terminology. This verifies the configuration effect of
datasetSearchUsingExtensionQuery.
The values provided here are common starting points, and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.