SECAI Core · phase 3 of 15
Semi-structured data
Data that is a mix of both structured and non-structured data.
The Explain card
- Plain English
- Semi-structured data mixes both worlds: it has some organising tags or keys, but not a rigid table layout. JSON, XML and log files are typical examples.
- Example
- A SIEM ingests JSON events from cloud services. Each record has fields, but different services include different fields, so the model must handle missing and extra keys.
- Why it matters
- Flexible formats let attackers smuggle unexpected fields, oversized values or injected text that parsers and models were not tested against. Schema validation matters even when the schema is loose.
- Hook
- Labelled boxes, but not all boxes hold the same things.
Where it sits in the deck
Phase 3: Data Fundamentals: Types, Pipelines, and Preparation
Models are only as good as their data — understand the raw material and the engineering that shapes it before covering how it flows or breaks.
