yash@infosec:~$ whoami
Yash Kant
▸Detection & Response·Endpoint & Cloud Security·CASB / SWG / DLP·Threat Hunting·Insider Risk
I work across enterprise security end-to-end — endpoint to cloud, identity to data. On any given day that's hunting threats and engineering detections, running incident response and insider-threat investigations, closing vulnerabilities, and hardening the environment against the next attack. When the manual way doesn't scale, I build the tooling that does.
// selected work
Things I've built
Defender Analysis Engine
Autonomous SOC analyst for Microsoft Defender for Endpoint
An autonomous-but-advisory SOC analyst that automates the full alert lifecycle — pulling alerts, grouping them into incidents, running multi-query KQL investigations, correlating behaviour across the MITRE ATT&CK kill chain, and emitting prioritized verdicts with the evidence behind them. It doesn't just suggest a query — it runs it, so a verdict can say “three other devices show this same indicator” instead of “you should go check.”
Read-only by design
MDE Fleet Remediation Toolkit
Guardrailed endpoint remediation at fleet scale
Detection is only half the job — risky software (bandwidth-resale proxyware, consumer VPNs, unauthorized AI code editors) has to actually be removed from live endpoints, safely and at scale. This write-capable toolkit does exactly that through Defender Live Response, deliberately isolated into its own sandbox so an automation bug can never reach the read-only production tooling.
Write sandbox · allowlist + dry-run
Netskope Investigation Agent
Read-only CASB / SWG / DLP investigation over the live tenant
Netskope's telemetry is rich but sprawling — hundreds of API paths. This agent distills it into nine focused investigation lenses over the live tenant (or offline exports), normalizing everything to a common schema so a SOC question like “what did this user touch” or “hunt this IP everywhere” is one command away. Read-only by construction — the API client exposes no write, patch, or delete methods at all.
Read-only by construction