---
title: Authoring a custom VST
description: Ensure Prelude CLI is installed and updated pip3 install prelude-cli pip3 install prelude-cli --upgrade Download an existing Prelude created VST via CLI to use as reference, in this example we will us
---

[Skip to content](https://support.preludesecurity.com/docs/custom-tests#main-content)

English

Show submenu for translations

[Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en)

![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact support](https://support.preludesecurity.com/kb-tickets/new)
- [Visit the website](https://www.preludesecurity.com/)

[Visit the website](https://www.preludesecurity.com/)

 Find what you're looking for

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en)
2. [Detect](https://support.preludesecurity.com/detect?hsLang=en)
3. [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)

# Authoring a custom VST

### **To create a custom VST**

1. Install [GO](https://go.dev/) for your platform and configure your preferred IDE
2. Ensure Prelude CLI is installed and updated
3. `pip3 install prelude-cli`
4. `pip3 install prelude-cli --upgrade`
5. Download an existing Prelude created VST via CLI to use as reference, in this example we will use "Colour-Blind Trojan" VST as an example.
6. List existing tests and their IDs: prelude detect tests
7. Download Prelude created test "Colour-Blind Trojan"  
   `prelude detect download ca9b22be-93d5-4902-95f4-4bc43a817b73`
8. Find downloaded folder "ca9b22be-93d5-4902-95f4-4bc43a817b73". Inside will be:  
   **Source Code** ca9b22be-93d5-4902-95f4-4bc43a817b73.go  
   **Readme file** that populates test details in console: README.md  
   **Attachments** referenced in test: colour-blind.py
9. Create your own test via CLI`prelude build create-test "test_name" --unit health`
10. Unit can be "health" or "response", the two major VST categories
11. This will generate a new test directory with the template source code inside.
12. You can use the previously downloaded Prelude generated test "Colour-Blind Trojan" as a template  
    or download any other Prelude test as reference.
13. update code, add new attachments to the same directory if applicable and update README.md file  
    to describe your test
14. Once you are happy with your test you will need to upload it to your account
15. Upload just the source code: `prelude build upload <uuid> .go`
16. Upload the entire test directory including README.md, attachments (test samples) and .go source  
    code: `prelude build upload <UUID>`
17. At this point the test will be visible in the UI or CLI and is available to be scheduled

You can provide a comment in the test code to direct the Platform to only compile a test for a specific Platform (Mac, Windows, Linux). If no comment exists then a binary is compiled for all three.

```
//go:build windows
// +build windows

//go:build linux
// +build linux

//go:build darwin
// +build darwin
```

The two comments should go at the top of the .go file before uploading to the Detect Platform.

Example:

![](https://support.preludesecurity.com/hubfs/Knowledge%20Base%20Import/1e3512b-image.png)

### Resources:

[VST Result Codes](https://support.preludesecurity.com/docs/understanding-results?hsLang=en)

- [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content)

    - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor)
    - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)
    - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations)
    - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations)
    - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations)
    - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations)
    - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations)
    - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations)
    - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations)
    - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting)
    - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting)
- [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content)

    - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics)
    - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations)
    - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)
    - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)
    - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)
    - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance)
- [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content)

    - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase)
- [Account](https://support.preludesecurity.com/account?hsLang=en#main-content)

    - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso)
- [CLI](https://support.preludesecurity.com/cli?hsLang=en)
- [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en)

[![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com)

Prelude Security Knowledge Base

Copyright © 2026, Origin Technology