What data for this category looks like
This category of data mainly comes from SIEM, EDR, NDR and threat intelligence sources, with update frequencies split into real-time and daily update types. Daily used and produced documents include alarm disposal sheets, duty records, threat intelligence reports, daily and weekly reports. The core fields of document structure are alarm ID, disposal time, associated IP, threat level and other fields. Single alarm data volume is small, but overall data volume fluctuates with alarm frequency, and there is no unified fixed long text format.
What constraints do these characteristics impose on the "context and token" link
Real-time updated alarm data requires the context window to quickly synchronize the latest information to avoid judgment lag. Daily updated weekly reports and report documents require stable long context loading capabilities. Documents mainly consisting of short text such as alarm disposal sheets need precise control of token consumption to avoid redundant content occupying quota. Mixed calls of multi-source data require the context to distinguish field attributes of different data sources to prevent confusion of associated information. Time-consuming links such as false positive elimination and escalation dispatch rely on complete context. Token overlimit will lead to missing judgment information, causing real attack missed reports or false positive accumulation.
How to set configurations
| Configuration Item | Recommended Value Range | Basis for This Setting |
|---|---|---|
maxContext | 8000–12000 token | Adapts to the mixed context loading requirements of multi-source alarms and duty records in SOC scenarios, and matches the context upper limit of mainstream large models |
quoteMaxToken | 2000–3000 token | Limits the token consumption of a single referenced document to avoid exceeding the quota for token occupation during single alarm judgment |
| Similarity Threshold | 0.5–0.7 | Adapts to the matching accuracy of short texts such as alarm disposal sheets, filters low-relevance threat intelligence content |
| Single Recall Count | Top 3–5 entries | Controls the total token occupation of the context, preventing overlimit caused by loading too much historical data |
| Context Refresh Interval | Real-time / 1 hour | Synchronizes the latest data in real-time alarm scenarios. For daily update document scenarios, refresh every 1 hour to balance performance and timeliness |
Three common configuration mistakes
- The phenomenon is that after setting the similarity threshold to 0.4, the required alarm disposal sheet content still cannot be recalled. The reason is that the threshold is too low, which introduces a large number of low-relevance historical alarm data and squeezes the context token quota, causing the target content to not be recalled preferentially.
- The phenomenon is that when binding a large model with a 16384 token upper limit, the output is truncated at 12288 tokens, the interface prompts that the reply limit is exceeded, and the log shows an input-output ratio of 31945/12288. The reason is that the
maxContextconfiguration exceeds the output token upper limit of the large model, and the total token of single recall is not limited, causing the total context token to exceed the quota after superposition. - The phenomenon is that token consumption cannot be counted by alarm application dimension. The reason is that the context dimension token statistics configuration is not enabled, or the identification field of the alarm application is not associated, resulting in the inability to split token consumption by business dimension.
How to confirm the configuration is correctly set
- Upload a single alarm disposal sheet, check whether the number of recalled associated documents is within the range of 3-5 entries.
- Submit a long-text threat intelligence report, check that the output is not truncated, and the total token displayed in the background log does not exceed the upper limit of the bound large model.
- Adjust the similarity threshold to 0.6, verify that low-relevance redundant content is filtered out, and the matching degree of recall results is improved.
- View the background statistics panel of FastGPT v4.17.0, confirm that token consumption can be split and counted by alarm application dimension.
The values listed above are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.