Bricklayer is an autonomous AI platform that automates security alert triage and indicator‑of‑compromise (IOC) investigation for SOC teams. It ingests alerts from cloud, endpoint, network, email and threat‑intel sources, enriches and correlates the data, and generates structured reports with remediation recommendations, including daily cyber situational updates. The solution reduces manual investigation time, improves coverage, and lets analysts focus on high‑impact response.
Funding
$5M raised to dateRaised to date based on public sources. This may differ from the amount the company actually raised and is based only on what is publicly available on the internet.
2OTSFounders
Product
Problem
Security Operations Centers (SOCs) are overwhelmed by high‑volume alerts from cloud platforms, endpoints, networks, email, and threat feeds, requiring manual triage, enrichment, and reporting that is time‑consuming, error‑prone, and limits response speed.
Solution
Bricklayer provides an autonomous, multi‑agent AI platform that ingests security alerts and indicators of compromise, enriches them with threat‑intel, correlates data across cloud, endpoint, network and email sources, and generates structured reports with remediation recommendations. The system reduces manual investigation time to minutes, improves coverage by querying dozens of intelligence sources simultaneously, and continuously updates a daily cyber situational report, enabling SOC analysts to focus on high‑impact response and proactive defense.
Target Audience
Primary customers are SOC teams within enterprises, Managed Security Service Providers (MSSPs), and security consulting firms that need to automate high‑volume alert triage, IOC investigation, vulnerability analysis, and threat‑actor research.
Features
- SOC Analyst Agent that automatically collects and prioritizes alerts from cloud, EDR, IDS/IPS, firewalls, email gateways and SIEMs
- Threat Intel Analyst Agent that enriches alerts and IOCs using multiple feeds (e.g., VirusTotal, AbuseIPDB, NVD, CISA, commercial intel) and maps findings to MITRE ATT&CK
- Incident Responder Agent that orchestrates containment actions and coordinates response workflows
- Reporter Agent that compiles findings into standardized, human‑readable reports for alerts, IOCs, threat actors, vulnerabilities and daily situational summaries
- Real‑time correlation engine that cross‑references alerts with internal asset inventories and business‑criticality data
- Integration layer supporting major cloud platforms, EDR solutions, network monitoring tools, email security gateways and threat‑intel platforms
- API and dashboard for analysts to review AI‑generated insights, export to SOAR/SIEM, and customize alert thresholds