Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
The following FINAL Office Action is in response to communication filed on 8/4/2026.
Status of Claims
Claims 1-4, 6-10, 13-15, 20, 23-25, 27-30 are currently pending.
Claims 1, 6, 15, 20 are currently amended.
Claims 11-12, 16-19, 21-22 were previously cancelled.
Claims 5, 26 are currently cancelled.
Claims 29-30 are newly added.
Claims 1-4, 6-10, 13-15, 20, 23-25, 27-30 are currently under examination and have been rejected as follows.
IDS
The information disclosure statements filed on 04/24/2024, 09/12/2024, 4/9/2026, 8/26/2026 comply with the provisions of 37 CFR 1.97, 1.98 and MPEP § 609 and is considered by the Examiner.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Response to Amendment
The previously pending rejections under 35 USC 101 will be maintained. The 101 rejection is updated in view of the amendments.
The previously pending rejections under 35 USC 103 are withdrawn in view of the amendments and arguments (see Applicant remarks dated 8/4/2026 pages 20-21 and the Allowable Subject Matter section below).
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Response to Arguments
Regarding Applicant’s remarks pertaining to 35 USC 101:
Step 2A Prong One:
Applicant argues on page 14 of remarks 8/4/2026:
“This feature recites a specific technical mechanism (the deployment and installation of a
software agent comprising a background thread that automatically records analyst actions and compiles a report), not a method of organizing human activity. Claim 1 further recites that the cyber threat investigation information is collected "without prompting an analyst operating the enterprise user device to record the cyber threat investigation information," and that the cyber threat investigation information "comprises the report" compiled by the background software thread. These features describe how a computing platform captures incident response data through a concrete software mechanism, not an abstract business concept.”
Examiner respectfully disagrees. The claims as amended recite, describe or set forth identifying potentially threatening cyber events, matching them to protective actions, and documenting and communicating a timeline of an incident response lifecycle from beginning to end for a customer (also see Applicant specification ¶ [0003]), which fall within mitigating risk as it pertains to fundamental economic principles and business relations as they pertain to commercial or legal interactions, each under the broader abstract grouping of Certain Methods of Organizing Human Activity. In a case that these functions are performed by software alone does not necessarily preclude the categorization of a judicial exception.
Applicant argues beginning on page 14 of remarks 8/4/2026:
“This shift-off/shift-on space-management mechanism, together with the specific temporal sequence of displaying events, alert generated elements, and information enrichment elements at successive points in time, describes the technical operation of a graphical user interface rather than a method of organizing human activity.
“Applicant submits that the Office Action's characterization of these features as "mitigating
risk" abstracts away the specific technical mechanisms recited in the claims, in precisely the manner cautioned against by the Desjardins memo and Enfish.”
Examiner respectfully disagrees. Referring to Applicant specification ¶ [0003]: “The computing platform may receive (e.g., from a client user device of the client and/or other devices), a request for the cyber threat investigation information. The computing platform may generate, using the cyber threat investigation information, a client interface, which may include a time-series graphical representation of the actions performed to address the identified threat and a play button, where selection of the play button causes automated progression through the time-series graphical representation within the client interface.” Examiner submits the functions described above by Applicant, supported by the claims and specification, amount to an animated illustration of a cyber threat life cycle, performed by an analyst, and presented to a user initiated by a play button. Examiner submits that though technology is used to perform these functions, the technical mechanisms do not eliminate the abstract idea.
Applicant argues on page 15 of remarks 8/4/2026:
“Claim 1, as amended, is unlike the claims in Recentive because it does not merely apply a generic tool or technique to a new field. Rather, claim 1 recites specific technical mechanisms (i.e., an installed background thread agent that compiles a report by recording actions performed at the enterprise user device, and a play-button-driven interface that shifts portions of the time-series graphical representation off and on the client interface) and the specification describes how these mechanisms are accomplished.”
Examiner respectfully disagrees. Examiner submits the present invention focuses not on the actions performed in the cyber threat life cycle itself, but on the collection of said cyber threat life cycle information and the presentation in an animated user interface environment to a user. Examiner again points to Applicant specification ¶ [0003]: “The computing platform may receive (e.g., from a client user device of the client and/or other devices), a request for the cyber threat investigation information. The computing platform may generate, using the cyber threat investigation information, a client interface, which may include a time-series graphical representation of the actions performed to address the identified threat and a play button, where selection of the play button causes automated progression through the time-series graphical representation within the client interface.” Akin to Recentive, this amounts to the execution of collecting, reporting, and presenting existing processes, in this case cyber threat mitigation, in a particular technological environment – the time series graphical interface.
Step 2A Prong Two:
Applicant argues on page 16 of remarks 8/4/2026:
“Here, the specification identifies a specific technical problem….
“Claim 1, as amended, now recites that technical solution as its first limitation…. This is not a generic computer component performing a generic function. Rather, it is a specific software agent deployed to and installed on a specific device, configured to perform a specific technical function (automatically recording actions and compiling a report without prompting the analyst).”
Examiner respectfully disagrees. Applicant specification ¶ [0001] and [0002] state “It may be important, accordingly, to grant clients access to this analysis and/or remediation action information” and “Accordingly, it may be important to improve the efficiency of such information collection”, respectively. Examiner submits challenges associated with providing access to cyber threat analysis and remediation information as well as efficiency in collecting that information, in other words information collection and presentation, are entrepreneurial challenges, even if the the solution is technological.
Applicant argues on page 16 of remarks 8/4/2026:
“The USPTO's Subject Matter Eligibility Examples provide further guidance. In particular,
claim 1 of Example 40 (Adaptive Monitoring of Network Traffic Data) was found eligible at Step 2A, Prong Two because "the claim as a whole is directed to a particular improvement in collecting
traffic data." USPTO Eligibility Example 40. Specifically, "the method limits collection of additional Netflow protocol data to when the initially collected data reflects an abnormal condition, which avoids excess traffic volume on the network and hindrance of network performance"…. Similarly, claim 1 is directed to a particular improvement in collecting incident response information (automatic collection in real time by the installed background software thread, without prompting the analyst), which avoids delaying the remediation process.”
Examiner respectfully disagrees. Although Examiner acknowledges similarity to Example 40 in terms of data collection, the practical application of the judicial exception was achieved in Example 40 through the analysis and identification of abnormal network traffic by the additional elements, leading to improved network performance. In the present invention, the cyber threat analysis has already been performed by a human analyst. The focus of the present invention is on collecting information about the human-performed analysis and remediation and presenting the information to a user.
Applicant argues on page 17 of remarks 8/4/2026:
“Additionally, claim 1 is analogous to claim 1 of USPTO Eligibility Example 23 (Graphical User Interface for Relocating Obscured Textual Information). In its analysis, the USPTO explains
that the Example 23 claim is patent eligible because "the claim recites dynamically relocating textual information within a window displayed in a graphical user interface based upon a detected
overlap condition," and as such, "the claimed method is necessarily rooted in computer technology to overcome a problem specifically arising in graphical user interfaces"…. Like the Example 23 claim, this limitation is necessarily rooted in computer technology to overcome a problem specifically arising in graphical user interfaces (namely, how to present a dynamically growing time-series representation within a finite display area) and improves the computer's ability to display information and interact with the user.”
Examiner respectfully disagrees. The present inventions solves the problem of the increasing volume of information not viewable all at once to be presented over time via an animated interface. The problem appears not to be the operation of the interface itself, but with the volume of information that needs to be presented. Eligibility is achieved in (hypothetical) Example 23 by addressing the problem of the GUI itself obfuscating text information from a user. The Example recites a method of dynamically resizing and reshaping displayed information in the GUI along with reformatting text to remain visible to a user when interface overlap occurs, demonstrating a technological improvement in how the GUI itself operates.
Applicant argues on page 17 of remarks 8/4/2026:
“The Desjardins memo also cites to SRI Int'l, Inc. v. Cisco Systems, noting that "claims to
detecting suspicious activity by using network monitors and analyzing network packets were found to be an improvement in computer network technology and not directed to an abstract idea."
Examiner respectfully disagrees. The present invention does not appear to focus on technological details of the actual detection and remediation of cyber threats, as would be analogous to SRI Int'l. Rather, Examiner submits the present inventions focuses on the recording of an analyst performing the detection and remediation of cyber threats and presentation of that information to a user.
Step 2B:
Applicant argues on page 18 of remarks 8/4/2026:
“…The Office Action alleges that the claims "fail to recite the technological details of how the actual technological solution to the actual technological problem is accomplished" and recite "no description of the mechanism for accomplishing the result." Office Action, p. 9. Applicant respectfully submits that claim 1, as amended, now recites precisely that mechanism…. This feature describes the technological details of how the report is compiled (through an installed background software thread that records actions) directly addressing the Office Action's stated concern.”
Examiner respectfully disagrees. Applicant specification ¶ [0012] states “The computing platform may automatically record, using the incident response documentation software, the user input. The computing platform may automatically compile, based on the user input, an incident response log.” Specification ¶ [0013] states “In one or more instances, automatically recording the user input may include: 1) identifying completion of a particular action of the one or more actions by an analyst operating the computing platform; and 2) storing, by the computing platform and in real time: a) an indication of the completion, b) a timestamp of the completion, and c) results of the completion, where… the user input includes user input corresponding to one or more of: alert generation actions, information enrichment actions, pattern matching actions, checklist completion actions, client notification actions, and threat remediation actions.” There does not appear to be any more specific technological detail of how this information is collected. The amended claim language includes “the background software thread is configured to automatically compile a report during an incident response lifecycle of an identified threat by recording actions performed at the enterprise user device to address the identified threat”. Examiner submits that installing software and using the software to compile a report by recording actions is too generic of a description of the features of the invention to demonstrate being significantly more than the judicial exception.
Applicant argues on page 18 of remarks 8/4/2026:
“Applicant further submits that nothing in the filed specification constitutes an express statement that the claimed combination is well-understood, routine, and conventional, as required
under MPEP 2106.05(d) and 2106.07(a). The ordered combination recited in claim 1 includes: (1)
the installed background-thread agent that automatically compiles the report by recording actions
without prompting the analyst; (2) the play button causing automated progression through the time- series graphical representation; (3) the shift-off/shift-on space management of the time-series graphical representation; ( 4) the specific temporal sequence of incident response lifecycle elements (events, alert generated element, and information enrichment element displayed at successive points in time); and (5) dynamic real-time updating of the client interface throughout the incident response lifecycle. This non-conventional, non-generic arrangement provides a technical improvement in cybersecurity incident response tracking and visualization.”
Examiner respectfully finds the argument unpersuasive. Examiner points to analogous arrangements of said technology in primary and secondary references Bhargava and Atkinson. Applicant specification ¶ [0002] states “It may be difficult, however, to obtain the analysis and/or remediation action information without impairing, hindering, and/or otherwise delaying the analysis process… which may, e.g., result in decreased efficiency in the cyber threat remediation process…. Accordingly, it may be important to improve the efficiency of such information collection.” While Examiner acknowledges potential improvement in entrepreneurial cybersecurity incident response tracking, particularly reducing or eliminating time consumption due to analyst manual reporting as well as providing real-time observation to clients, improvement to the computer technology itself is unclear.
Accordingly, the previously pending rejections under 35 USC 101 will be maintained. The 101 rejection is updated in view of the amendments.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-4, 6-10, 13-15, 20, 23-25, 27-30 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Claims 1-4, 6-10, 13-14, 23-25, 28-30 are directed to a computing platform or machine which is a statutory category.
Claims 15 is directed to a method or process which is a statutory category.
Claim 20 is directed to non-transitory computer-readable media or article of manufacture which is a statutory category.
Step 2A Prong One: The claims recite, describe, or set forth a judicial exception of an abstract idea (see MPEP 2106.04(a)). Specifically, the claims recite, describe or set forth mitigating risk and business relations including: “generation of an enhanced cyber threat analysis framework”, “…compile a report during an incident response lifecycle of an identified threat by recording actions performed at the enterprise user device to address the identified threat”, “receive… cyber threat investigation information indicating actions performed to address an identified threat for a client through an incident response lifecycle of the identified threat… wherein the cyber threat investigation information comprises the report”, “receive… a request for the cyber threat investigation information”, “initially displaying events of the incident response lifecycle at one or more points in time”, “displaying… an alert… generated corresponding to the one or more events”, “displaying… events… enriched with additional threat information”. Identifying potentially threatening cyber events, matching them to protective actions, and documenting and communicating a timeline of an incident response lifecycle from beginning to end for a customer fall within mitigating risk as it pertains to fundamental economic principles and business relations as they pertain to commercial or legal interactions, each under the broader abstract grouping of Certain Methods of Organizing Human Activity (MPEP 2106.04(a)(2) II). Accordingly, the claims recite an abstract idea.
Step 2A Prong Two: Independent claims 1, 15, 20 recite the following additional elements: “computing platform”, “processor”, “communication interface”, “memory”, “enterprise user device”, “client user device”, “client interface”, and “non-transitory computer-readable media”. The functions of these additional elements include examples such as “receive, from an enterprise user device, cyber threat investigation information”, “cyber threat investigation information is collected through a threat framework interface at the enterprise user device”, “receive, from a client user device of the client, a request for the cyber threat investigation information”, “generate, using the cyber threat investigation information, a client interface”, and “send, to the client user device, the client interface and one or more commands directing the client user device to cause display of the client interface”. The additional elements are recited at a high level of generality (i.e. as a generic computer performing functions sending and receiving information, generating user interfaces based on the information, and displaying the information) such that they amount to no more than mere instructions to apply the exception using generic computer components. Therefore, these functions can be viewed as not meaningfully different than a business method or mathematical algorithm being applied on a general-purpose computer as tested per MPEP 2106.05(f)(2)(i), generating a second menu from a first menu and sending the second menu to another location as performed by generic computer components as tested per MPEP 2106.05(f)(2)(ii), or requiring the use of software to tailor information and provide it to the user on a generic computer as tested per MPEP 2106.05(f)(2)(v). The claims are directed to an abstract idea and the judicial exception does not integrate the abstract idea into a practical application.
Step 2B: According to MPEP 2106.05(f)(1), considering whether the claim recites only the idea of a solution or outcome i.e., the claims fail to recite the technological details of how the actual technological solution to the actual technological problem is accomplished. The recitation of claim limitations that attempt to cover an entrepreneurial and thus abstract solution to an entrepreneurial problem with no technological details on how the technological result is accomplished and no description of the mechanism for accomplishing the result do not provide significantly more than the judicial exception.
Dependent claim 5 recites the additional element “background software thread”. Dependent claim 7 recites the additional elements “scoring algorithms” and “analyst interface”. Dependent claim 8 recites the additional element “second enterprise user device”. Dependent claims 23-24 recite the additional elements “event circle element”, “exclamation triangle element”, “brain element”, “bracket element”, “clipboard element”, “group of people [element]”, and “protection shield element”. Dependent claim 26 recites the additional element “incident response documentation software”. The additional elements are also recited at a high level of generality (i.e. as a generic computer performing functions of receiving selections, compiling information, scoring events, displaying information, recording actions, etc.) such that they amount to no more than mere instructions to apply the exception using generic computer components.
Further, dependent claims 2-4, 6, 9, 13-15, 25, 27-30 merely incorporate the additional elements recited in claims 1, 15, 20 along with further narrowing of the abstract idea of claims 1, 15, 20 along with their execution of the abstract idea. Specifically, dependent claims narrow the computing platform, processor, communication interface, memory, enterprise user device, client user device, client interface, non-transitory computer-readable media, background software thread, scoring algorithms, second analyst interface, and second enterprise user device to capabilities such as display, receive, identify, indicate, compile, generate, send, shift, and update various forms of data such as alerts, events, enrichment information, graphical representations, graphical elements, timelines, intelligence, incidents, actions, addresses, domains, users, files etc. which, when evaluated per MPEP 2106.05(f)(2) represent mere invocation of computers to perform existing processes. Therefore, the additional elements recited in the claimed invention individually and in combination fail to integrate a judicial exception into a practical application (Step 2A prong two) and for the same reasons they also fail to provide significantly more (Step 2B). Thus, claims 1-4, 6-10, 13-15, 20, 23-25, 27-30 are reasoned to be patent ineligible.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Allowable Subject Matter
Claims 1-4, 6-10, 13-15, 20, 23-25, 27-30 are allowable over the prior art in view of the amendments and Applicant remarks dated 8/4/2026 pages 20-21. However, these claims remain rejected under 35 USC 101.
Closest prior art to the invention includes Bhargava US 20200067985 A1, Systems and methods of interactive and intelligent cyber – security; and Atkinson et al. US 20210250365 A1, Cyber defence system. The incorporation of the features of now-cancelled claim 26 into independent claims 1, 15, 20 render the independent claims and by extension their independent claims allowable over the prior art. Specifically, none of the prior art of record, taken individually or in combination, teach or suggest the independent claim limitations as detailed below:
[..]
send, to the enterprise user device, incident response documentation software and one or more commands directing the enterprise user device to install the incident response documentation software, wherein: the incident response documentation software comprises the background software thread, and the background software thread is configured to automatically compile the report during the incident response lifecycle by recording actions performed at the enterprise user device to address the identified threat;
[..]
generate, using the cyber threat investigation information, a client interface, wherein the client interface includes a time-series graphical representation of the actions performed to address the identified threat and a play button, wherein selection of the play button causes automated progression through the time-series graphical representation within the client interface, and causes a first portion of the time-series graphical representation to shift off the client interface and a second portion of the time-series graphical representation to shift on to the client interface, wherein actions represented in the first portion occurred prior to actions represented in the second portion, wherein generating the client interface includes dynamically updating the client interface in real time throughout the incident response lifecycle, and wherein updating the client interface includes updating the time-series graphical representation;
[..]
[..] in response to the selection of the play button:
initially displaying one or more events of the incident response lifecycle at one or more initial points in time on the time-series graphical representation,
displaying, after displaying the one or more events and at a second point in time on the time-series graphical representation, later than the one or more initial points in time, an alert generated element, indicating that an alert has been generated corresponding to the one or more events, and
displaying, after displaying the alert generated element and at a third point in time on the time-series graphical representation, later than the second point in time, an information enrichment element, indicating that the one or more events have been enriched with additional threat information.
Examiner notes as previously communicated in Office Action dated 5/5/2026 that dependent claims 23 and 24 also contain features which would overcome prior art if recited independently. However, claims 23 and 24 are now allowable anyway by extension of claims 1, 20 respectively.
Examiner reminds Applicant that novelty (35 USC 102) and non-obviousness (35 USC 103) still pertain to features that are mostly abstract that do not render the claims patent eligible (35 USC 101). The novel and non-obviousness rationale above do not necessarily render the claims patent eligible. The claims remain rejected under 35 USC 101.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Conclusion
The following art is made of record and considered pertinent to Applicant’s disclosure:
Amsler US 20140259170 A1, Internet security cyber threat reporting system and method.
Bazalgette et al. US 20220224724 A1, Artificial intelligence based analyst as an evaluator.
Beck et al. US 20190260804 A1, Secure communication platform for a cybersecurity system.
Bednash et al. US 20240045964 A1, Cybersecurity active defense and rapid bulk recovery in a data storage system.
Böhm, Fabian, Florian Menges, and Günther Pernul. "Graph-based visual analytics for cyber threat intelligence." Cybersecurity 1.1 (2018): 16.
https://link.springer.com/article/10.1186/s42400-018-0017-4#citeas
Boyer WO 2021171093 A1, Cyber security software for a software-as-a-service factoring risk.
Dominessy et al. US 10868825 B1, Cybersecurity and threat assessment platform for computing environments.
Kashyap et al. US 9092625 B1, Micro-virtual machine forensics and detection.
Lewis US 20220046047 A1, Monitoring and preventing remote user automated cyber attacks.
Lim US 20180324202 A1, System and method for threat incident corroboration in discrete temporal reference using 3D dynamic rendering.
Muddu et al. US 20170063899 A1, Interactive threat geo-map for monitoring computer network security.
Ringlein et al. US 20200401696 A1, Security incident disposition predictions based on cognitive evaluation of security knowledge graphs.
Thomas et al. US 20170063920 A1, Dynamic adaptive defense for cyber-security threats.
Tock et al. US 20220414217 A1, System and method of protecting client computers.
Dames US20200374681A1, Situational awareness systems and methods.
Forte US20210398001A1, Cybersecurity incident response and security operation system employing playbook generation and parent matching through custom machine learning.
Ingalls US20210218649A1, Network security monitoring and correlation system and method of using same.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to REED M. BOND whose telephone number is (571) 270-0585. The examiner can normally be reached Monday - Friday 8:00 am - 5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Patricia Munson can be reached at (571) 270-5396. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/REED M. BOND/Examiner, Art Unit 3624
September 17, 2026 /HAMZEH OBAID/Primary Examiner, Art Unit 3624
Prosecution Insights