Operate the app
Permissions, stable event inspection, signing identity, Audit rules, network evidence, website allowlists and Threat Center readiness, explained with real UI captures.
Orbitus Robotics / Free security handbook
ROB ViperSecurity Operations Handbook
Turn a scanner result into a defensible decision. A practical, illustrated guide to malware triage, dependency CVEs, macOS hardening and the people who own the next action.
By Rodolfo Aramayo · First edition · November 2026
70 PDF pages30 chapters24 UI figuresFree
PDF: fixed layout · EPUB: adjustable text, linked contents and image descriptions. No account required.
Files uploaded to Apple Books. Free pricing and store availability are still pending; download the PDF or EPUB here now.
From the first scan to a team workflow
Learn the tools.
Understand the evidence.
Investigate malware leads
ClamAV signatures, EICAR controls, YARA-X rule review, static inspection, behavior correlation, false positives, evidence preservation and the boundary of a controlled lab.
Work a CVE to closure
Trivy inventory, dependency paths, CVSS, EPSS and KEV context, remediation choices, SBOM and CI handoffs, exceptions and proof that a fix reached deployment.
Build an organizational practice
Operator and analyst roles, case ownership, MDM pilots, schedules, incident decisions, recovery evidence, retention and privacy. Proposed workflows are labeled clearly.
Read hardening findings
What FileVault off means, how posture differs from malware detection, and why unknown or incomplete results must stay visible.
Practice with harmless data
Generate positive and negative controls, a metadata-only vulnerable lockfile and an optional scan-limit fixture. No real malware or old dependency installation is required.
A small lab you can inspect
Practice the analysis.
Keep the decision human.
The companion includes a Python fixture generator, a bounded JSON report reviewer, instructions and a case template. It creates a new directory you choose. It does not install tools, contact a server or change policy. EICAR intentionally exercises antivirus detection; read the instructions first.
Tested controls, bounded conclusions.
Seven scoped live cases passed: clean text, EICAR, positive and negative YARA controls, dependency advisories, over-limit coverage and changed-rule rejection. Ten helper tests check malformed input and missing evidence. A passing exercise does not establish complete malware detection or production readiness.
Inside the book
Thirty chapters to use at your desk.
- 01 / How to use this handbook
- 02 / Choose the right security question
- 03 / Prepare permissions and prove collection
- 04 / Inspect events without losing the record
- 05 / Rehearse execution rules before enforcement
- 06 / Investigate network evidence and constrain access
- 07 / Prepare Threat Center and its tools
- 08 / Malware concepts that change the investigation
- 09 / Open a case and preserve useful evidence
- 10 / Run ClamAV and interpret a signature result
- 11 / Coverage gaps, archives and false positives
- 12 / Write, review and test a YARA-X rule
- 13 / Inspect macOS artifacts without launching them
- 14 / Correlate behavior signals with events
- 15 / Use controlled execution only in a prepared lab
- 16 / What a CVE scan actually tells you
- 17 / Scan dependency manifests with Trivy
- 18 / A reproducible CVE analysis exercise
- 19 / Prioritize with context, CVSS, EPSS and KEV
- 20 / Remediate and prove the deployed change
- 21 / Use SBOMs and CI without hiding failures
- 22 / Build an organizational analysis workflow
- 23 / Plan an MDM pilot and central administration
- 24 / Schedule work at the right time
- 25 / Respond to a suspicious result
- 26 / Exercise the program with harmless controls
- 27 / Read posture and understand FileVault
- 28 / Export, retain and communicate evidence
- 29 / Case templates, checklists and daily reference
- 30 / Glossary, sources and edition evidence
Edition and scope.
Edition 1.0 documents ROB Viper 0.7.0 build 12, a development preview. The handbook is free; the app has separate distribution requirements. A public production installer and live fleet rollout remain pending. Read the current product status before planning deployment.
The 70-page PDF was rendered and reviewed. The reflowable EPUB passes EPUBCheck 5.4.0 with no errors or warnings, and includes descriptive alternative text and semantic navigation. The PDF is visually designed; use the EPUB for semantic reading support. No independent accessibility certification is claimed.
Copyright 2026 OrbitusRobotics LLC. All rights reserved. Free pricing does not change copyright or third-party software licenses. This is an independent operating guide; references to Apple, ClamAV, Trivy and YARA-X do not imply endorsement.
Report a correction or discuss an organizational workshop · Browse the Orbitus library