Step 3: Structured JSON Output

Why Structured Output?

When LLM output feeds into another system (SIEM, ticketing, firewall rules), you need machine-readable data -- not prose. Compare:

The JSON version can be consumed directly by a SIEM rule engine, a ticketing API, or an automated response playbook.

Instructing the Model to Return JSON

system = """You are a security log classifier.
Respond with valid JSON only. No prose, no markdown fences, no explanation.

Output schema:
{
  "threat_type": "string (e.g. brute_force, lateral_movement, exfiltration)",
  "technique_id": "string (MITRE ATT&CK ID, e.g. T1110)",
  "severity": "Critical | High | Medium | Low",
  "confidence": "float 0.0-1.0",
  "recommended_actions": ["list of strings"]
}"""

response = client.chat(
    system=system,
    messages=[{"role": "user", "content": "198 failed SSH logins from 45.33.32.156 in 60 seconds"}],
    max_tokens=300,
)

Parsing and Validating the Response

import json

def parse_classification(response_text):
    """Parse and validate LLM JSON output."""
    try:
        data = json.loads(response_text)
    except json.JSONDecodeError:
        return {"error": "Model returned invalid JSON", "raw": response_text}

    # Validate required fields
    required = ["threat_type", "severity", "confidence"]
    missing = [f for f in required if f not in data]
    if missing:
        return {"error": f"Missing fields: {missing}", "raw": response_text}

    # Validate severity value
    valid_severities = {"Critical", "High", "Medium", "Low"}
    if data["severity"] not in valid_severities:
        data["severity"] = "Unknown"

    # Validate confidence range
    if not (0.0 <= data.get("confidence", 0) <= 1.0):
        data["confidence"] = 0.0

    return data

result = parse_classification(response)
print(json.dumps(result, indent=2))

Never trust raw LLM output. Always validate structure, field presence, and value ranges before passing to downstream systems.

Common Failure Modes