AppleTV and Jellyfin

 I like the AppleTV - what a great little bit of kit. The sad thing is, the application that connects to my Jellyfin server has been very hit and miss. I've tried a few different things and it has not been a great outcome at times. 

Swiftfin was OK but had issues with some file types and then stopped working entirely. I'm not sure what happened with it, so I got frustrated and ditched it.

JellyTV was initially promising and the carousel look was pretty neat, but the connection to my server was consistently crap and fell over a lot. It would stop playing videos, lag, and have all kinds of problems. No network issues or anything like that so again, I got frustrated and got rid of it.

Infuse looked amazing, but as soon as I tried to play anything it wanted to upgrade to Pro and that was that. Off with it. Open Source for the win!

Ah look! A new version of Swiftfin has arrived. I installed it - it looks different, and the functionality has improved. OK that's exciting - initial testing is going very well.

At the back end of all of this I added an Nvidia graphics adaptor to my server to try and improve Jellyfin's capabilities and it has certainly helped, especially with the higher end formats of videos (8K for example). I thought this would help the AppleTV deliver vision to my eye balls better, but it did not. It appears the app you use is a big chunk of the problem and so getting the right one is key. My continued testing has shown Swiftfin to work pretty well. It's supposed to be a native app so my expectations are it will work fairly well. 

I have read that the Jellyfin leads have finished up or walked off? I'm not sure, but I want to thank everyone who has worked on the project - it's pretty amazing and works really well. You all have done a great job and end users like me are very grateful. 

Humbled playing Elden Ring

 I've been a computer gamer for a long time - and I mean like, a really long time. Think Double Dragon on an old Amstrad around the late 1980's old.

To wind down and relax I've picked up a few different games, and being older and behind the time I'll often grab a game that's a couple of years old, cheap on the Microsoft Store or Steam and then launch into it. My little fella encouraged me to try Subnautica - saying it looked pretty cool. 

And it is! I dived into the game (see what I did there? :-) ) and got into it, dying very frequently and enjoying some of the jump scares as the aquatic life decided I was a tasty morsel and good for a bite. Lots of fun indeed. I finished it, ran through it again with a lot more panache and far fewer deaths and got into the second iteration - Subnautica Sub Zero which adds some entertaining cold environment and ice related elements to it. While not as long as the first one, it was very enjoyable and the new equipment and habitats fun to mess around with.

Subnautica 2 has come out in a pre-release version and I've gotten as far as I can in that too. My advice is simple when playing these games - pay attention and search everything! Also, watch out for the big fish!

I quite like the Dungeons & Dragons style of games and have spent many, many hours in Skyrim, Oblivion and Baldurs Gate (1, 2 and 3), so I decided to try out another in development game Enshrouded. Quite fun indeed and nearing the 1.0 release so it's quite polished. I've risen in levels and found that the inevitable grind has impacted my enjoyment somewhat. My nephew suggested Elden Ring, citing it was the best game he's played, he's finished it and it is a challenge.

A challenge you say! Well let's get to it.

Yes it indeed is a challenge and I had my butt whipped on a very constant basis. One cannot simply swing a sword with abandon in Elden Ring - you get killed, and you get killed frequently. The very first major dude kicks your arse and that's when I thought it might be worth checking out a bit of Youtube or other media to learn about this game before I rage quit forever. It turns out that the designers really don't want you to just bash your way through, and you need to take your time. I have not yet passed through much of the game - I am still learning all the ways that this game subtly differs from the aforementioned fun I've had in the more survival, base building type games. Elden Ring is not that kind of game. 

It's refreshing to come up against a game I can't just blast through, but equally frustrating because a lot of the tried and true techniques I've used in the past are not applicable. I'm also battling with the keyboard and mouse - my normal modus operandi, as I'm playing on my Legion gaming laptop. Sadly, I think this might be easier with a game pad of some type. As I've bought it through Steam, I'm not that keen to re-buy it on PS5 which is a bummer. 

So far, it's been very swearingly frustrating, yet equally entertaining. Stay tuned as I attempt to get myself through a play session without dying (it hasn't happened yet). 

Webtop - an impressive remote access tool

 I've been looking for a while for something that allows me to remotely access my home systems. I can't use a VPN, or RDS to connect back to my systems, so it had to be something useful via a web interface. Finding an option that allows for a Remote Desktop in a web interface isn't easy. I tried a few different options and had very little success, which was annoying and required quite some time to get things to work. Until I stumbled on webtop! You can find it here: https://docs.linuxserver.io/images/docker-webtop/ and it's worth having a look at.

I'm running it in docker, and I used this https://github.com/linuxserver/docker-webtop to set it up. The process is relatively straightforward and I'm running it in a Linux container. I've found with my server that 4vCPUs, 6GB of RAM and a 30GB disk have proven adequate for my daily computing needs via the webtop system.

It's an immutable file system, so any changes you make will be rolled back on restarting it. Instead, to add more software, you must use the Proot method - this makes the software stick. My needs are relatively simple, so I've installed Obsidian and a different browser. It wall works very acceptably, is fairly quick and usable. I also use the built in Office system LibreOffice for spreadsheets and files. The Documents/Downloads etc folders are not immutable and these retain your changes which is handy. I've had it manage some very sizeable spreadsheet files and it was fine to use. 

One of the great things about using Webtop is having a foothold outside of the office, so if I'm doing pen testing, or vulnerability scanning I can do it from outside the production network and see what I can find. It also allows me to access different websites than what I can see in the office. For example, if we have a class of websites blocked, like AI ones, but I'd like to read about Claude Mythos I can't at work, no matter how important it is for actual work. So I can use webtop to do that research without waiting until I get home. 

It's handy also, because you can drag stuff to the webtop page and upload it into your desktop or file system. As an exfiltration system it could be very good, so I made sure our DLP was up to the challenge - and it proved an interesting test system to verify that the DLP rules were working and firing when they were supposed to. 

I haven't go screenshots for you to see - instead go and check out the developer's site and spin it up in a docker container. It won't take long and the outcome is a great tool for work and play. 

TheHive - an excellent case management tool for Digital Forensics!

 In my work in cybersecurity, I've been quietly using TheHive made by Strange Bee https://strangebee.com/thehive/ for the last few years. Initially I was searching for something to analyse forensic data and stumbled on this project. It's got both an Open Source and a paid version, and I've had great value from the community version. Paired with Cortex, TheHive is a powerful tool for the cybersecurity professional. Cortex is the system that does the analysis of your artefacts and then reports back into TheHive. This isn't the only integration that TheHive supports. You can push new cases into it from both MISP and from Wazuh, and then run triage and analysis from within TheHive. It will push details back into MISP so when you review an alert or report, then you can classify it in TheHive once, and it will update it back into MISP which is pretty neat.

Here is what a couple of entries on the Dashboard looks like:

The dialogue box to create a case is below 

And this is what the case page looks like:

Typically, I'll do the following:

• Create a case, choosing the appropriate level of severity
• Add at least one task to the case - usually "Review Observables" which is TheHive talk for artefacts associated with the case - and these can be all different types
• Add the observables - of which there can be many types as seen in this screenshot: 
  
  
  
  and with the "Type" sorted out:
  
  
  
  Here is where TheHive and Cortex shine together. The observable type is linked to analytics that Cortex runs for you - you'll have to set it up, but the good news is, it's quite straightforward and can all run on a single server. Cortex will run the analysis of your observable and then report back. For example, you might configure Cortex to query Google DNS for bad websites, VirusTotal for known bad artefacts, AbuseFinder is handy, and so is Urlscan.io. Here is an example of what a couple of bad IP addresses look like after Cortex has analysed them:
  
  Red is bad, Orange is suspected bad and green is... well Cortex either isn't sure or the results are inconclusive. 

Cortex requires some grunt to run, so when you read that TheHive + Cortex needs 16GB of RAM and at least 8 CPUs you can understand why - with many concurrent analytics being performed against the observables, and doing it in a timely manner. I run it on my Proxmox server and it gets along quite adequately. 

When you're working through the case, I use the Tasks to capture what I'm seeing, and use the "Comments" to report on my findings. These can be timestamped (which you should always do) and if you happen across an observable or a similarity to another case, TheHive will automatically link it through. Then you can begin the next phase of action, whatever that may be, and track the case to its finale. In the example above, we saw significant attacks on our Web Application Firewall and blocked the addresses, fixing the problem from a known bad (at the time) IP address. It may have been fixed since, and that's why it is important to re-analyse observables. Hijacked sites/IPs or similar can be recovered and I always want to give my fellow cyber security and IT pros the chance to fix their systems without needlessly blocking anyone. 

TheHive has nice reporting (I don't have an example that doesn't have sensitive data in it), and I've found as a system for managing what I am seeing and being asked to respond to, it has been excellent. I use the Community edition - I don't get a lot of cases through work, but I do get a few when I'm helping out people outside of the office and TheHive is great for supporting that community work. I've had several interactions with their team and they've been generally very good, so thank you StrangeBee members!

I've meant to write about TheHive for a while - it's a great tool, and I think that if you've got a forensic element to your work it can really add value to that work.