What Data Looks Like for This Category
Data for this category primarily originates from target systems, public vulnerability databases, automated scanner results, and manual verification records from red team engineers. Four types of documents are generated daily: test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Each document type includes fields such as project number, vulnerability ID, verification steps, and risk level. Data updates follow individual project cycles, or are synchronized during major system version or vulnerability database updates. In operations on-duty and internal ticket Q&A scenarios, rapid association of project data corresponding to the current ticket is required to avoid ineffective cross-project retrieval.
Constraints Imposed by These Characteristics on Reranking and Hybrid Retrieval
Test authorization letters contain legally authorized content. Retrieval processes must prioritize matching authorization scope to avoid recalling unauthorized test data and prevent legal authorization disputes. Penetration test reports and vulnerability reproduction records include technical details. During hybrid retrieval, public vulnerabilities must be distinguished from undisclosed internal verification results to ensure compliance of recalled content. Data is updated per project, so retrieval processes must filter by project dimension to avoid ineffective cross-project recall. The vulnerability verification process takes significant time, so relevant retrieval results must be ranked first to help engineers quickly locate verification basis and improve on-duty efficiency.
Configuration Settings
The following configurations are formulated for FastGPT v4.17.0.
| Configuration Item | Recommended Value Range | Rationale |
|---|---|---|
| Similarity threshold | 0.75–0.82 | Match the authorization scope of test authorization letters and ticket keywords, filter out recall results that exceed permissions |
| Maximum single search results | Top 6–10 | Adapt to the total number of documents for a single penetration test project, avoid excessive redundant data entering subsequent processing steps |
| Retrieval mode | hybrid | Combine vector retrieval and keyword retrieval to cover structured fields in vulnerability databases and unstructured content in manual verification records |
| Reranking toggle | Enabled | Rerank initial recall results by vulnerability risk level and project relevance, prioritize displaying high-priority content related to the current ticket |
| Maximum context length | 1200–1500 characters | Accommodate complete technical details of penetration test reports, avoid truncating key verification steps |
Three Common Configuration Mistakes
- Phenomenon: After enabling the reranking function, the interface returns a timeout, with latency exceeding 30 seconds. Cause: The input text length of the reranking model is not limited, or batch processing parameters for the reranking model are not configured, resulting in excessive data processed in a single batch.
- Phenomenon: After configuring the reranking model, no reranking results are returned during online recall testing. Cause: Reranking association configuration is not enabled during the knowledge base indexing phase, or the reranking model is not deployed to a server in the same network segment as FastGPT, resulting in call failure.
- Phenomenon: The reranking model continuously occupies GPU video memory and cannot automatically release it. Cause: Model unloading trigger logic is not configured, or video memory occupancy threshold is not set, causing the model to remain in video memory after retrieval completes.
How to Verify Successful Configuration
- Access the FastGPT knowledge base management page, confirm the retrieval mode is set to hybrid retrieval and the reranking toggle is enabled.
- Submit a test ticket containing a project number and vulnerability keywords, check if recall results are sorted by risk level first.
- View system logs, confirm the reranking model triggers video memory release logic after retrieval completes, with no continuous memory occupancy.
- Adjust the similarity threshold, verify if the number and relevance of recall results meet current business requirements.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.