<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:atom="http://www.w3.org/2005/Atom"
     xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Subhash Bharadwaj · The words</title>
    <link>https://subhashb05.in/words/</link>
    <atom:link href="https://subhashb05.in/words/rss.xml" rel="self" type="application/rss+xml" />
    <description>Technical deep-dives on detection engineering and OT security, plus dispatches from everything around it.</description>
    <language>en</language>
    <copyright>© 2026 Subhash Bharadwaj</copyright>
    <managingEditor>subhashb.dev@zohomail.in (Subhash Bharadwaj)</managingEditor>
    <webMaster>subhashb.dev@zohomail.in (Subhash Bharadwaj)</webMaster>
    <lastBuildDate>Fri, 24 Jul 2026 00:00:00 GMT</lastBuildDate>
    <ttl>1440</ttl>
    <image>
      <url>https://subhashb05.in/og.png</url>
      <title>Subhash Bharadwaj · The words</title>
      <link>https://subhashb05.in/words/</link>
    </image>
    <item>
      <title><![CDATA[Twenty-nine rules and a plastic PLC]]></title>
      <link>https://subhashb05.in/words/ot-sentinel-29-rules/</link>
      <guid isPermaLink="true">https://subhashb05.in/words/ot-sentinel-29-rules/</guid>
      <pubDate>Fri, 24 Jul 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Subhash Bharadwaj]]></dc:creator>
      <category><![CDATA[technical]]></category>
      <category><![CDATA[OT/ICS]]></category>
      <category><![CDATA[Wazuh]]></category>
      <category><![CDATA[Modbus]]></category>
      <category><![CDATA[detection engineering]]></category>
      <category><![CDATA[MITRE ATT&CK]]></category>
      <description><![CDATA[Major SIEMs ship with zero coverage for the protocols that run industrial plants. I spent a few months building 29 rules for the five that matter, and learning why the honest answer to "is it validated?" is longer than yes.]]></description>
    </item>
    <item>
      <title><![CDATA[The benign log is the one that matters]]></title>
      <link>https://subhashb05.in/words/the-benign-log/</link>
      <guid isPermaLink="true">https://subhashb05.in/words/the-benign-log/</guid>
      <pubDate>Fri, 17 Jul 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Subhash Bharadwaj]]></dc:creator>
      <category><![CDATA[technical]]></category>
      <category><![CDATA[detection engineering]]></category>
      <category><![CDATA[Wazuh]]></category>
      <category><![CDATA[NIST CSF]]></category>
      <category><![CDATA[testing]]></category>
      <category><![CDATA[compliance]]></category>
      <description><![CDATA[Any rule can be made to fire. Making it stay quiet on traffic that merely resembles an attack is the hard half, and it's the half most detection packs never test. Notes from building a 57-test evidence harness.]]></description>
    </item>
    <item>
      <title><![CDATA[Field notes 001: why a cabin]]></title>
      <link>https://subhashb05.in/words/field-notes-001/</link>
      <guid isPermaLink="true">https://subhashb05.in/words/field-notes-001/</guid>
      <pubDate>Fri, 10 Jul 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Subhash Bharadwaj]]></dc:creator>
      <category><![CDATA[dispatch]]></category>
      <category><![CDATA[meta]]></category>
      <category><![CDATA[design]]></category>
      <description><![CDATA[A short note on what this site is, why it looks the way it does, and what it's for.]]></description>
    </item>
    <item>
      <title><![CDATA[Teaching an LLM to hunt threats: building the Wazuh MCP server]]></title>
      <link>https://subhashb05.in/words/wazuh-mcp-server/</link>
      <guid isPermaLink="true">https://subhashb05.in/words/wazuh-mcp-server/</guid>
      <pubDate>Thu, 09 Jul 2026 00:00:00 GMT</pubDate>
      <dc:creator><![CDATA[Subhash Bharadwaj]]></dc:creator>
      <category><![CDATA[technical]]></category>
      <category><![CDATA[MCP]]></category>
      <category><![CDATA[Wazuh]]></category>
      <category><![CDATA[agentic AI]]></category>
      <category><![CDATA[Python]]></category>
      <category><![CDATA[security design]]></category>
      <description><![CDATA[Most SIEM tooling was never built with language models in mind. This is the story of wiring an LLM directly into Wazuh: 28 tools, nine security domains, and the design decisions that made it safe to run.]]></description>
    </item>
  </channel>
</rss>