The words
Long-form technical writing, and shorter dispatches from everything around it. Two tracks, one feed.
4 pieces · 16 min of reading
Twenty-nine rules and a plastic PLC
Major SIEMs ship with zero coverage for the protocols that run industrial plants. I spent a few months building 29 rules for the five that matter, and learning why the honest answer to "is it validated?" is longer than yes.
The benign log is the one that matters
Any rule can be made to fire. Making it stay quiet on traffic that merely resembles an attack is the hard half, and it's the half most detection packs never test. Notes from building a 57-test evidence harness.
Field notes 001: why a cabin
A short note on what this site is, why it looks the way it does, and what it's for.
Teaching an LLM to hunt threats: building the Wazuh MCP server
Most SIEM tooling was never built with language models in mind. This is the story of wiring an LLM directly into Wazuh: 28 tools, nine security domains, and the design decisions that made it safe to run.