What the data for this category looks like
This category of data primarily comes from SIEM, EDR, NDR, and third-party threat intelligence sources, updated in real time or daily. Daily documents include alarm disposal tickets, on-duty records, threat intelligence bulletins, and security operation daily and weekly reports. Each data entry contains fields such as alarm ID, trigger time, threat level, associated asset IP, and disposal status. Some documents include full alarm context and historical disposal records to support daily analysis and ticket assignment for SOC analysts.
Constraints on re-ranking and hybrid retrieval
Real-time updated alarm data requires the retrieval pipeline to respond quickly, to avoid delayed alarm analysis caused by latency. Multi-source heterogeneous data formats require hybrid retrieval to adapt to different document structures, ensuring reasonable retrieval weights for different documents such as alarm disposal tickets and threat intelligence bulletins. Daily updated weekly report and bulletin documents require periodic refresh of the retrieval index to ensure the latest operation data can be retrieved. Unique identifiers of alarm fields can be used for precise recall, but alarms with different threat levels have varying retrieval relevance requirements, so re-ranking logic needs targeted adjustments.
Configuration Settings
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
usingReRank | Enabled | Adapts to the relevance ranking requirements of multi-source heterogeneous data in SOC duty scenarios, improves the accuracy of alarm analysis, and must be used with the re-ranking model calling logic of FastGPT v4.17.0 |
similarity | 0.72–0.85 | Covers the recall range of alarms with different threat levels, avoids low-correlation false positives from mixing into retrieval results, and meets the accuracy requirements of security operation analysis |
limit | Top 10 entries | Balances retrieval recall volume and subsequent re-ranking calculation overhead, adapts to the response speed requirements of real-time alarm analysis, and prevents excessive computing resource usage in the re-ranking stage |
searchMode | hybrid | Combines vector retrieval and keyword retrieval to support hybrid retrieval of structured fields such as alarm ID and asset IP, as well as natural language descriptions, covering multiple types of retrieval scenarios |
Three Common Mistakes
- No change in retrieval result order after enabling
usingReRank. The interface displays retrieval results in the same order as when re-ranking is not enabled. The cause is incorrect configuration of re-ranking model calling parameters, or incompatibility between the re-ranking model and the current FastGPT version. - Retrieval response timeout. The interface returns a loading timeout prompt or system error. The cause is an excessively high
limitvalue for a single recall, resulting in excessive re-ranking calculation volume that exceeds the allowable response duration of the retrieval pipeline. - Too high proportion of low-threat level alarms in retrieval results. The returned alarm data does not match the high-priority threat intent of the query. The cause is a
similarityvalue that is too low, resulting in recall of a large number of low-correlation false positive data.
How to Verify Correct Configuration
- Navigate to the knowledge base settings page in FastGPT, confirm that the
usingReRankswitch is enabled. - Execute a query containing high-threat level and core asset IP keywords, and compare the difference in retrieval result order before and after enabling re-ranking.
- Check the system retrieval logs to confirm that there are re-ranking model calling records and no error messages.
- Adjust the
similarityvalue, observe changes in the number of retrieved results, and verify that the parameter takes effect.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.