DETAILED ACTION
Claims 1-20 are pending in this action.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 12, 15 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Dempsey et al. (US Patent No. 6,507,852) [hereinafter “Dempsey”] in view of Hu et al. (US PGPUB No. 2018/0097744) [hereinafter “Hu”] in further view of Chao (WO-2018218184-A1).
As per claim 1, Dempsey teaches a method comprising: accessing, by a data platform, a custom policy that invokes a query written in a query language associated with the data platform, the query defining an attribute (Abstract, querying event log based on attributes defined in an alert policy see also Col. 7, lines 37-40) and the custom policy defining an action associated with the attribute (Abstract, alert action is associated with a triggering event in accordance with the alert policy); detecting, by the data platform based on the query and within a target dataset, data characterized by the attribute (Col. 4, lines 45-67, gathering event messages based on rules defining criteria, i.e. eventID’s); and providing, by the data platform, a query result associated with the data characterized by the attribute (Col. 5, lines 1-10, eventID’s and counts and time period are tracked), the query result annotated in accordance with the custom policy to indicate the detecting of the data characterized by the attribute and to direct the action to be performed (Col. 5, lines 14-20, event data is used to determine alert action).
Dempsey does not explicitly teach ingesting, by the data platform by way of a network from a cloud environment comprising one or more compute assets, a target dataset associated with the one or more compute assets using at least one of an agent deployed within the cloud environment or an agentless configuration. Hu teaches ingesting, by the data platform by way of a network from a cloud environment comprising one or more compute assets, a target dataset associated with the one or more compute assets using at least one of an agent deployed within the cloud environment or an agentless configuration ([0045], using agents and agentless means to collect data across cloud from network resources).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey with the teachings of Hu, ingesting, by the data platform by way of a network from a cloud environment comprising one or more compute assets, a target dataset associated with the one or more compute assets using at least one of an agent deployed within the cloud environment or an agentless configuration, to a dynamic and versatile system for ingesting data across disparate network components.
The combination of Dempsey and Hu does not explicitly teach executing the query on the target dataset as the target dataset is ingested into the data platform; detecting, by the data platform based on the query and within the target dataset, data characterized by the attribute, wherein detecting the data characterized by the attribute is performed during ingestion of the target dataset. Chao teaches executing the query on the target dataset as the target dataset is ingested into the data platform (Page 56, lines 20-25, updating and training are performed while queries are being processed and used to update the metadata and assets); detecting, by the data platform based on the query and within the target dataset, data characterized by the attribute, wherein detecting the data characterized by the attribute is performed during ingestion of the target dataset (Page 52, lines 4-17, converting query vector into metadata vector used to search and filter the database – this is done simultaneously to the training and updating of the database and the metadata associated records in the database see Page 56, lines 20-25).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey and Hu with the teachings of Chao, executing the query on the target dataset as the target dataset is ingested into the data platform; detecting, by the data platform based on the query and within the target dataset, data characterized by the attribute, wherein detecting the data characterized by the attribute is performed during ingestion of the target dataset, to a dynamic and versatile system for ingesting data across disparate network components.
As per claim 12, the combination of Dempsey, Hu and Chao teaches the method of claim 1, wherein: the directing of the action to be performed includes directing a user interface of the data platform to display an alert or a report to a user (Dempsey; Abstract, alerting user based on whether events trigger various alert policies, i.e. attributes - sending email or page to user would be a display of an alert see Col. 5, lines 15-20); and the alert or the report indicates the detecting of the data characterized by the attribute (Dempsey; Col. 3, lines 4-7, alerting user of specific types of events).
As per claim 15, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale.
As per claim 17, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale.
Claims 2, 3, 5, 6, 16 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu and Chao in further view of Narayanaswamy et al. (US PGPUB No. 2016/0275303) [hereinafter “Narayanaswamy”].
As per claim 2, the combination of Dempsey, Hu and Chao teaches the method of claim 1, wherein: the target dataset comprises trail data (Dempsey; Abstract, event log for events in a network with client/server technology see Col. 2, lines 55-62) that includes a plurality of events records generated within the cloud environment with respect to the client application data (Dempsey; Col. 3, lines 7-12, event log is maintained for client computer and applications running on the client see Col. 3, lines 27-35) and the data detected within the target dataset to be characterized by the attribute includes one or more event records of the plurality of event records (Dempsey; Col. 4, lines 34-43, events stored in the event log with various attributes including eventID’s see Col. 5, lines 4-10).
The combination of Dempsey, Hu and Chao does not explicitly teach the cloud environment stores and executes client application data Narayanaswamy teaches the cloud environment stores and executes client application data ([0084], cloud service storing application and user data for providing a service to users, i.e. Google Apps, Microsoft Office, etc.).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu and Chao with the teachings of Narayanaswamy, the cloud environment stores and executes client application data, to update the event logging to reflect data received from more contemporary networks.
As per claim 3, the combination of Dempsey, Hu, Chao and Narayanaswamy teaches the method of claim 2, wherein the cloud environment is associated with Amazon Web Services (AWS) (Narayanaswamy; [0084], Amazon AWS) and the trail data is CloudTrail data provided by AWS (Examiner Note: the feature states that CloudTrail data is inherent to Amazon AWS see also pertinent art below Kirti Table 1).
As per claim 5, the combination of Dempsey, Hu, Chao and Narayanaswamy teaches the method of claim 1, wherein the attribute characterizing the data detected based on the query corresponds to a predetermined data security threat (Narayanaswamy; [0170], analyzing raw event data corresponding to established security policies).
As per claim 6, the combination of Dempsey, Hu, Chao and Narayanaswamy teaches the method of claim 1, wherein the attribute characterizing the data detected based on the query corresponds to a failure to satisfy a predetermined compliance rule (Narayanaswamy; [0170], analyzing raw event data corresponding to established data integrity policies, i.e. compliance with integrity policies).
As per claim 16, the substance of the claimed invention is identical or substantially similar to that of claim 2. Accordingly, this claim is rejected under the same rationale.
As per claim 18, the substance of the claimed invention is identical or substantially similar to that of claim 2. Accordingly, this claim is rejected under the same rationale.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu, Chao and Narayanaswamy in further view of Iasi et al. (US PGPUB No. 2017/0208050) [hereinafter “Iasi”].
As per claim 4, the combination of Dempsey, Hu, Chao and Narayanaswamy teaches the method of claim 2, wherein the one or more event records included in the data detected to be characterized by the attribute (Dempsey; Col. 4, lines 45-67, gathering event messages based on rules defining criteria, i.e. eventID’s).
The combination of Dempsey, Hu, Chao and Narayanaswamy does not explicitly teach wherein the events are attempts to log into a service account of the cloud environment from one or more unauthorized IP addresses. Iasi teaches wherein the events are attempts to log into a service account of the cloud environment from one or more unauthorized IP addresses ([0024], login attempts from unauthorized IP addresses onto cloud systems see [0031]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu, Chao and Narayanaswamy with the teachings of Iasi, wherein the events are attempts to log into a service account of the cloud environment from one or more unauthorized IP addresses, to apply security policies to the event logging functions taught in Dempsey which makes the system more versatile to users.
Claims 7-9 are rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu, Chao and Narayanaswamy in further view of Yalamanchi (US PGPUB No. 2005/0222996).
As per claim 7, the combination of Dempsey, Hu, Chao and Narayanaswamy teaches the method of claim 1.
The combination of Dempsey, Hu, Chao and Narayanaswamy does not explicitly teach providing, by the data platform, an application programming interface (API) that supports the query language and is configured to facilitate query and custom policy creation; wherein the accessing of the custom policy and the providing of the query result are both performed by way of the API. Yalamanchi teaches providing, by the data platform, an application programming interface (API) that supports the query language and is configured to facilitate query and custom policy creation ([0017] and [0060], query language and [0050] rule set creation); wherein the accessing of the custom policy and the providing of the query result are both performed by way of the API ([0060], API used to manage rules and query events).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu, Chao and Narayanaswamy with the teachings of Yalamanchi, providing, by the data platform, an application programming interface (API) that supports the query language and is configured to facilitate query and custom policy creation; wherein the accessing of the custom policy and the providing of the query result are both performed by way of the API, to apply security policies to the event logging functions taught in Dempsey which makes the system more versatile to users.
As per claim 8, the combination of Dempsey, Hu, Chao, Narayanaswamy and Yalamanchi teaches the method of claim 7, wherein the API is further configured to facilitate updating and deletion of queries and custom policies (Yalamanchi; [0023], updating and deleting existing rules which can represent queries and policies see [0022] and [0071] via an API see [0060]).
As per claim 9, the combination of Dempsey, Hu, Chao, Narayanaswamy and Yalamanchi method of claim 7, further comprising providing, by the data platform for use by a user of the data platform, a graphical user interface that implements the API and provides graphical assistance to the user as the user creates at least one of the query or the custom policy (Yalamanchi; [0060]-[0061], API creating queries and rules which can represent policies see [0071]).
Claims 10, 11, 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu and Chao in view of Van Osten et al. (US PGPUB No. 2018/0314740) [hereinafter “Van Osten”].
As per claim 10, the combination of Dempsey, Hu and Chao teaches the method of claim 1.
The combination of Dempsey, Hu and Chao does not explicitly teach wherein the ingesting comprises loading the target dataset into a data store; and wherein the detecting of the data characterized by the attribute and the providing of the query result are performed during the ingesting prior to the target dataset being completely loaded into the data store. Van Osten teaches wherein the ingesting comprises loading the target dataset into a data store ([0018], client data along with interaction data from the cloud are stored in a datastore for querying see Abstract); wherein the detecting of the data characterized by the attribute and the providing of the query result are performed during the ingesting prior to the target dataset being completely loaded into the data store ([0014] and [0054], no limitations are placed on the users as to when they can query the database and as to the storage of network events where datastores inherently allow for continuous storage of data).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu and Chao with the teachings of Van Osten, wherein the ingesting comprises loading the target dataset into a data store; and wherein the detecting of the data characterized by the attribute and the providing of the query result are performed during the ingesting prior to the target dataset being completely loaded into the data store, to allow queries to be made anytime and when necessary giving users on demand access to event data.
As per claim 11, the combination of Dempsey, Hu and Chao teaches the method of claim 1.
The combination of Dempsey, Hu and Chao does not explicitly teach wherein the ingesting comprises loading the target dataset into a data store; wherein the detecting of the data characterized by the attribute and the providing of the query result are performed subsequent to the target dataset being completely loaded into the data store. Van Osten teaches wherein the ingesting comprises loading the target dataset into a data store ([0018], client data along with interaction data from the cloud are stored in a datastore for querying see Abstract); wherein the detecting of the data characterized by the attribute and the providing of the query result are performed subsequent to the target dataset being completely loaded into the data store ([0014] and [0054], users have the ability to set a time period for the queried data with a start and end time meaning the target dataset in this embodiment would be completely loaded into the datastore).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu and Chao with the teachings of Van Osten, wherein the ingesting comprises loading the target dataset into a data store; wherein the detecting of the data characterized by the attribute and the providing of the query result are performed subsequent to the target dataset being completely loaded into the data store, to allow queries to be made anytime and when necessary giving users on demand access to event data.
As per claim 19, the substance of the claimed invention is identical or substantially similar to that of claim 10. Accordingly, this claim is rejected under the same rationale.
As per claim 20, the substance of the claimed invention is identical or substantially similar to that of claim 11. Accordingly, this claim is rejected under the same rationale.
Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu and Chao in view of Petersen et al. (US PGPUB No. 2011/0314148) [hereinafter “Petersen”].
As per claim 13, the combination of Dempsey, Hu and Chao teaches the method of claim 1.
The combination of Dempsey, Hu and Chao does not explicitly teach wherein the custom policy is generated based on a default policy provided by the data platform, such that the custom policy inherits one or more attributes of the default policy while modifying one or more other attributes of the default policy. Peterson teaches wherein the custom policy is generated based on a default policy provided by the data platform, such that the custom policy inherits one or more attributes of the default policy while modifying one or more other attributes of the default policy ([0127], customizing particular default values from the original policy).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu and Chao with the teachings of Peterson, wherein the custom policy is generated based on a default policy provided by the data platform, such that the custom policy inherits one or more attributes of the default policy while modifying one or more other attributes of the default policy, to give users the flexibility to decide whether customization is necessary.
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Dempsey, Hu and Chao in view of Van Osten in further view of Chen et al. (WO-0227528-A1) [hereinafter “Chen”].
As per claim 14, the combination of Dempsey, Hu and Chao teaches the method of claim 1.
The combination of Dempsey, Hu and Chao does not explicitly teach constructing, by the data platform and based on client application data ingested from a cloud environment and loaded into a data store. Van Osten teaches constructing, by the data platform and based on client application data ingested from a cloud environment and loaded into a data store ([0018], client data along with interaction data from the cloud are stored in a datastore for querying see Abstract).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu and Chao with the teachings of Van Osten, constructing, by the data platform and based on client application data ingested from a cloud environment and loaded into a data store, to allow queries to be made anytime and when necessary giving users on demand access to event data.
The combination of Dempsey, Hu, Chao and Van Osten does not explicitly teach a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from the client application data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge. Chen teaches a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from the client application data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge (Page 2, lines 6-15, creating a database using a graph with nodes and edges which can be queried for event attributes).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Dempsey, Hu, Chao and Van Osten with the teachings of Chen, a graph comprising a plurality of nodes connected by a plurality of edges, wherein each node of the plurality of nodes represents a logical entity from the client application data and each edge of the plurality of edges represents a behavioral relationship between nodes connected by the edge, to store data in a graph database which provides different types of relationship data which could assist in querying.
Response to Arguments
Applicant pointed out an error in the citation of the prior art reference, “Hu” which was incorrectly cited as “US PGPUB No. 2017/0097744” but should have been cited as “US PGPUB No. 2018/0097744”. Examiner apologizes for the error and has corrected the citation. Examiner has kept the rejection as non-final.
Examiner asks that Applicant reconsider the rejection in light of the new citation and to refile the same arguments if they still hold true with any additional comments/remarks.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PETER C SHAW whose telephone number is (571)270-7179. The examiner can normally be reached Max Flex.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached on 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PETER C SHAW/Primary Examiner, Art Unit 2493 September 24, 2026
