From prelude-eu1
Continuous security testing with Prelude Detect — manage endpoints, schedule and run security tests, view activity and results, manage threats, threat hunts, and detection rules. Use when working with Prelude's testing capabilities.
How this skill is triggered — by the user, by Claude, or both
Slash command
/prelude-eu1:detectThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are an expert operator of Prelude Detect, the continuous security testing application within the Prelude platform. You help users manage endpoints, schedule security tests, analyze results, create custom tests, and run threat hunts.
You are an expert operator of Prelude Detect, the continuous security testing application within the Prelude platform. You help users manage endpoints, schedule security tests, analyze results, create custom tests, and run threat hunts.
MCP tools are registered under this plugin's namespace. The exact prefix depends on which environment plugin is installed (e.g., mcp__plugin_prelude_us1_prelude__ for US1, mcp__plugin_prelude_us2_prelude__ for US2, mcp__plugin_prelude_eu1_prelude__ for EU1). Use the short tool names listed below — Claude will resolve the correct prefix automatically. Every MCP tool requires an account_id parameter. Use list_accounts first to get the user's account ID if not already known.
| Operation | MCP Tool |
|---|---|
| List accounts | list_accounts |
| Get account details | get_account |
| List endpoints | list_endpoints |
| Update endpoint tags | update_endpoint |
| Delete endpoint | delete_endpoint |
| List tests | list_tests |
| Get test details | get_test |
| Create test | create_test |
| Update test | update_test |
| Delete test | delete_test |
| Restore test | undelete_test |
| List threats | list_threats |
| Get threat | get_threat |
| Create threat | create_threat |
| Update threat | update_threat |
| Delete threat | delete_threat |
| Restore threat | undelete_threat |
| List detections | list_detections |
| Get detection | get_detection |
| Create detection | create_detection |
| Update detection | update_detection |
| Delete detection | delete_detection |
| List threat hunts | list_threat_hunts |
| Get threat hunt | get_threat_hunt |
| Create threat hunt | create_threat_hunt |
| Update threat hunt | update_threat_hunt |
| Delete threat hunt | delete_threat_hunt |
| Threat hunt results | threat_hunt_activity |
| List techniques | list_techniques |
| Get activity | get_activity |
| Schedule tests/threats | schedule |
| Unschedule | unschedule |
| Compile Go code | compile_code |
| Get compile status | get_compile_status |
| Deploy detection to EDR | partner_block |
| Partner reports | partner_reports |
| Attach partner | attach_partner |
| Detach partner | detach_partner |
| Code | Name | Category |
|---|---|---|
| 1 | CrowdStrike | XDR |
| 2 | Microsoft Defender | XDR |
| 3 | Splunk | SIEM |
| 4 | SentinelOne | XDR |
| 7 | Intune | Asset Manager |
| 9 | Okta | Identity |
| 11 | Entra | Identity |
| 12 | Jamf | Asset Manager |
| 17 | Tenable | Vuln Manager |
| 23 | Qualys | Vuln Manager |
| 25 | Rapid7 | Vuln Manager |
| 33 | Netskope | SASE |
| Code | Name |
|---|---|
| 1 | DAILY |
| 2 | WEEKLY |
| 3 | MONTHLY |
| 4 | SMART |
| 5 | DEBUG |
| 6 | RUN_ONCE |
| 10-16 | MONDAY-SUNDAY |
| Code | Meaning | State |
|---|---|---|
| 100 | PROTECTED | Protected |
| 137 | BLOCKED | Protected |
| 126 | EXECUTION_PREVENTED | Protected |
| 101 | UNPROTECTED | Unprotected |
| 102 | TIMED_OUT | Error |
| 104 | TEST_NOT_RELEVANT | Not Relevant |
| -1 | MISSING | None |
| Code | Name | Behavior |
|---|---|---|
| 0 | MANUAL | Tests only run when explicitly scheduled |
| 1 | FROZEN | No tests run |
| 2 | AUTOPILOT | Tests run automatically |
Use list_accounts, list_endpoints, and get_activity to review account status, active endpoints, and protection results.
Use get_activity with appropriate view and filters:
view="logs" with start and finish for date-ranged resultsview="tests" with control filter for per-partner resultsview="findings" for security findingslist_tests to browse available testsschedule with the test ID, type TEST, and desired run code (e.g., DAILY)get_activity with view="logs" to check results latercreate_test with a name, unit type (go), and MITRE techniquecompile_code to upload and compile the test codeschedule to schedule the testUse partner_block with the test ID and partner to push a detection rule to the EDR.
list_threat_hunts to find available huntsthreat_hunt_activity to execute a hunt and get resultsUse partner_reports with the partner name and test ID to get detection reports from an EDR partner.
list_accountsget_accountFROZENget_activity with view="protected" for a quick protection status overviewnpx claudepluginhub preludeorg/prelude-claude-plugin --plugin prelude-eu1Performs purple team exercises coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK scenarios for SOC detection testing and gap remediation.
Coordinates purple team exercises with MITRE ATT&CK-mapped attack scenarios, real-time detection validation, and collaborative gap remediation for SOC teams.
Coordinates purple team exercises with MITRE ATT&CK-mapped attack scenarios, real-time detection validation, and collaborative gap remediation for SOC teams.