What data for this category looks like
Data sources for this category include SIEM, EDR, NDR, and threat intelligence feeds. Update cadences are split into two categories: real-time and daily. Daily processed documents include alarm disposal sheets, on-duty records, threat intelligence notifications, and daily/weekly reports. Alarm disposal sheets include the following fields: alarm ID, source IP, disposal status, and disposal time. On-duty records include: on-duty period, alarm entries, and ticket assignment records. Threat intelligence notifications include: threat level, IOC value, and notification time. Most field formats are strings, IPv4/IPv6 addresses, and ISO 8601 time formats, with no additional custom units.
Constraints on deployment and upgrade workflows
The requirement to access multi-source data means compatible data source synchronization rules must be configured during deployment, to prevent conflicts between alarm data from different systems. Real-time and daily update cadences require sufficient database connection resources to handle high-frequency alarm write and query requests. Diverse document structures require adapting field rules for different documents during the knowledge base import phase, to avoid data parsing errors. During the upgrade phase, database migration compatibility must be maintained to prevent interruptions to real-time alarm data or loss of existing knowledge base content. The index storage logic of the new version must also be adapted to avoid retrieval function failures. Special attention must be paid to the matching between database configuration and index generation when deploying or upgrading FastGPT v4.17.0.
How to set configuration values
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
DB_MAX_LINK | 100–200 connections | Adapts to the high-concurrency write requirements of real-time alarms, matches the concurrency processing limit of open-source versions v4.9.14 and above, and avoids database connection exhaustion |
MONGODB_URI | mongodb://[username]:[password]@host:port/fastgpt_soc?authSource=admin | Stores structured documents such as alarm disposal sheets and on-duty records, supports fast queries by alarm ID and time dimension |
REDIS_URL | redis://:password@host:port/0 | Caches temporary real-time alarm data to reduce high-frequency query pressure on the database, matching real-time update frequencies |
STORAGE_S3_ENDPOINT | https://s3-cn-beijing.aliyuncs.com | Stores large attachments such as threat intelligence notifications, adapting to multi-source data storage requirements |
FILE_TOKEN_KEY | 32-character random string | Ensures access security for knowledge base imported documents, preventing unauthorized access to sensitive alarm data |
FE_DOMAIN | https://your-soc-fastgpt-domain.com | Configures the platform access domain name, ensuring normal integration with internal operations and ticket systems |
Three common configuration errors
- Importing a CSV-format alarm disposal sheet into the knowledge base results in garbled Chinese characters, even if the character encoding is manually set. The cause is that the source file's encoding format does not match the default encoding of the FastGPT system, and the correct encoding parameter was not specified during the import process.
- After upgrading from FastGPT v4.9 to v4.10, existing knowledge base indexes fail to return search results, only returning an empty list. The cause is that the v4.10 version adjusted the vector index storage structure, and retrieval failed because the index for existing knowledge bases was not regenerated.
- After upgrading from v4.9.13 to v4.10.1, knowledge base content does not appear on the new instance. The cause is that the database migration operation was not performed correctly, and old-version knowledge base data was not synchronized to the new database instance.
How to verify proper configuration
- Run a multi-data source access test: pull one test alarm data set from SIEM and EDR, verify that it can be successfully synchronized to the FastGPT knowledge base and generate a corresponding entry.
- Import a CSV file of alarm disposal sheets containing Chinese content, check that Chinese text in the document displays correctly with no garbled characters or missing characters.
- After starting the FastGPT service, access the domain name configured in
FE_DOMAIN, verify that the platform interface loads normally with no access errors. - Run a vector retrieval test: enter an alarm ID keyword, verify that matching knowledge base entries are returned, confirming that the retrieval function works normally.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.