DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-8, 11-16, and 19-20 are pending this office action.
Response to Amendment
This Office Action is in response to applicant’s communication filed on September 26th, 2025. The Applicant’s remark and amendments to the claims were considered with the results that follow.
In response to the last office action, claims 1, 6, 8, 11, 12, 19, and 20 have been amended. Claims 9, 10, 17, and 18 have been canceled. As a result, claims 1-8, 11-16, and 19-20 are pending in this office action.
Applicant’s argument filed on September 26th, 2025, with respect to claims 1-20 as being directed to being abstract idea have overcome the invention. The rejection have been withdrawn due to the arguments filed on September 26th, 2025.
Response to Arguments
Applicant’s argument with respect to 35 U.S.C 101 rejection have been considered and the rejection has been withdrawn.
Applicant’s arguments, see pg. 11-14, filed September 26th, 2025, with respect to the rejections of claims 1, 12, and 20 under 35 U.S.C 103 have been fully considered but are moot in view of the new grounds of rejection necessitated by applicant’s amendment.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-8, 12-14, 16, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over U.S Patent Application Publication 2017/0052831 issued to Wu et al. (hereinafter as "Wu") in view of U.S Patent Application Publication 2018/0307734 issued to Bingham et al. (hereinafter as "Bingham") in further view of U.S Patent Application Publication 2021/0352099 issued to Kenneth Allen Rogers (hereinafter as "Rogers").
Regarding claim 1, Wu teaches a computer-implemented method of automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment (Wu: [0021]; The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time), the method comprising: monitoring, by one or more processors (Wu: [0015]; Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics), one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects (Wu: [0021]; The data collection rules may indicate one or more types of data to be collected, types of operations to be performed on data to be collected, an amount of data to be collected, a time at which the data is to be collected, a frequency at which the data is to be collected, and/or operating conditions of the device 102 under which the data is to be collected, for example. The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
obtaining, by the one or more processors (Wu: [0015]; Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics), historical operational data of the technical environment and historical resource data of the technical environment, wherein the historical operational data and the historical resource data were generated by the one or more objects (Wu: [0021]; For example, the telemetry module 108 may receive instructions, which may be a data collection pattern comprised of one or more data collection rules, from the service provider 114. [0024]; the data collection and analysis engine integrated with the application 106 may be employed to collect, analyze, and report application data from the device 102. [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
generating, by the one or more processors (Wu: [0015]; Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics), based on the historical operational data and the historical resource data, one or more models to evaluate health states and resource states of the one or more objects (Wu: [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern comprised of one or more data collection rules 216 provided by the service provider 220. [0034]; The telemetry module 306 may provide and/or report the collected and analyzed data to a service provider associated with the application. Upon receipt of the collected and analyzed data, the service provider may efficiently implement processes to address issues);
generating, by the one or more processors (Wu: [0015]; Moreover, those skilled in the art will appreciate that embodiments may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics), the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example).
Wu does not explicitly teach applying, by the one or more processors, the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology;
However, Bingham teaches applying, by the one or more processors (Bingham: [0240]; The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output), the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line). [0139]; Through this monitoring, activity monitor 315 can detect values of performance metrics, such as CPU usage, memory usage, task assignment counts, task assignment types…detect values of performance metrics, such as CPU usage, memory usage…Activity monitor 315 stores the detected values of performance metrics in activity data store 320 at block 910), wherein
the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line), wherein the identifying comprises determining a risk level for the at least an object (Bingham: [0172]; In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
obtaining, by the one or more processors (Bingham: [0240]; The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output), a topology of the technical environment (Bingham: [0102]; In some instances, interface engine accesses a set of values for a given component, and generates and presents a table, list, or graph to illustrate a change in a performance);
utilizing, by the one or more processors (Bingham: [0240]; The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output), the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology (Bingham: [0169]; The presentation of the architecture can include identifying all components and relationships in the architecture or a subset of the components and relationships. The subset can include, e.g., components in a highest level in the architecture or in the highest n levels (e.g., n being 2, 3, 4, etc.). [0171]-[0172]; The performance state can include an overall performance state. The overall performance state can be determined based on a plurality of factors, such as CPU usage, memory usage, task-processing times, task-processing intake numbers, and/or received or transmitted task migrations. In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models (See Bingham: [0017]). In addition, the references (Wu and Bingham) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu and Bingham are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Although, Wu teaches the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example). The modification of Wu and Bingham does not explicitly teach generating, by the one or more procesors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment.
Rogers teaches generating, by the one or more processors (Rogers: [0094]; The server system 118 executes (e.g., on one or more processors 52 of the server system 118)), the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Rogers: [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110, [0095]; In general, the event data collected by the entity event collectors 110 is used (e.g., by the server system 118) to generate entity relationship information indicating entities 8 and relationships between entities 8. In one example, the entity relationship information includes an entity relationship graph 162. [0122]; how the entity relationship graph 162 stored in the graph database 140 is logically organized (e.g., with nodes 10 representing entities 8 of the computer environment, edges 11 between the nodes 10 representing relationships between the entities 8 represented by the nodes 10 {Examiner correlates the identified subset of the one or more objects based on the entity relationship graph}), wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level (Rogers: [0014]-[0015]; Examples of such data collection include monitoring log files, listening on event queues for events generated by various technologies and data sources, or pulling information from existing systems in the computer environment that are already aggregating data from multiple sources…proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0027]; Calculation of the risk scores can recur c based on an evaluation frequency associated with each risk object. The resulting scores are stored for future reference and/or time series or trending analyses. In one example, each of the resulting scores for each calculation is stored for each risk object as a node in the risk hierarchy with an edge connecting the risk score node to the risk object node. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110);
automatically generating, by the one or more processors (Rogers: [0094]; The server system 118 executes (e.g., on one or more processors 52 of the server system 118)), based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment (Rogers: [0015]; proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110 [0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
deploying, by the one or more processors (Rogers: [0094]; The server system 118 executes (e.g., on one or more processors 52 of the server system 118)), the command files to the technical environment (Rogers: [0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the further teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment). One of ordinary skill in the art would have been motivated to make such a combination of establish a mechanism to have a current accurate model of entities in a computing environment in such to mitigate the attributes among the entities to provide better performance for the computing environment (See Rogers: [0318]). In addition, the references (Wu, Bingham, and Rogers) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, and Rogers are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Regarding claim 2, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Wu further teaches the resource aware dynamic operational data collection comprises elements selected from the group consisting of: dynamic profiles, dynamic configuration files, dynamic scripts, and dynamic parameters (Wu: [0012]; The telemetry module may also include various specialized components configured to dynamically scale data collection and analysis performed by the data collection and analysis engine for a target device. For example, a scaling profile manager may be configured to receive a profile for a device on which the application is being executed from the service. The scaling profile manager may be further configured to determine one or more resources and capabilities of the device, compare the determined resources and capabilities to the criteria of the profile, and scale the data collection and analysis to be performed by the data collection and analysis engine based on the comparison. Scaling may include adjusting parameters of the data collection and analysis such that the parameters correspond to the resources and capabilities of the device).
Regarding claim 3, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Wu further teaches the models are selected from the group consisting of: health models and resource models (Bingham: [0102]; an interface engine 375 that enables a reviewer 115 to request a performance report and/or receive a performance report. The report can include one or more statistics, states, and/or alarm statuses. The report can identify which component and/or time period are associated with the statistic, state and/or alarm status. Interface engine 375 can present most-recent or substantially real-time values (e.g., numerical statistics or states) and/or historical values).
Regarding claim 5, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Bingham further teaches identifying the at least one object of the one or more objects as abnormal comprises determining that the at least one object is operating outside of expected parameters of a model of the one or more models (Bingham: [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line). [0092]-[0093]; A statistics generator 340 can access the collection of performance metrics and generate one or more performance statistics based on the values of one or more performance metrics. A performance statistic can pertain to any of the various types of performance metrics, such as a CPU usage, a memory usage, assigned tasks, a task-completion duration, etc…use the state criteria and the generated statistic to assign a state (e.g., to a component and/or time period)).
Regarding claim 6, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Bingham further teaches generating the one or more models to evaluate health states and resource states of the one or more objects comprises utilizing the historical operational data and the historical resource data to establish the expected parameters (Bingham: [0093]; The state can then be stored (e.g., in association with a respective component and/or time period) in a state data store 360. State engine 350 can identify which component and/or time period are to be associated with the state based on what aggregation was performed. [0102]; an interface engine 375 that enables a reviewer 115 to request a performance report and/or receive a performance report. The report can include one or more statistics, states, and/or alarm statuses. The report can identify which component and/or time period are associated with the statistic, state and/or alarm status. Interface engine 375 can present most-recent or substantially real-time values (e.g., numerical statistics or states) and/or historical values. [0120]; Further, the historical plot may allow a reviewer 125 to notice a positive or negative trend in the values of one or more performance metrics, such that a problem can be remedied before it becomes serious. [0131]; One such comparison is an inter-system-component comparison, which can enable a reviewer 125 to identify a reasonableness of a performance metric and determine a level at which a problem could best be addressed).
Regarding claim 7, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Bingham further teaches utilizing the topology to identify the subset of the one or more objects which are impacted by the at least one object comprises determining an impact scope of the at least one object (Bingham: [0169]; The presentation of the architecture can include identifying all components and relationships in the architecture or a subset of the components and relationships. The subset can include, e.g., components in a highest level in the architecture or in the highest n levels (e.g., n being 2, 3, 4, etc.). [0171]-[0172]; The performance state can include an overall performance state. The overall performance state can be determined based on a plurality of factors, such as CPU usage, memory usage, task-processing times, task-processing intake numbers, and/or received or transmitted task migrations. In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances).
Regarding claim 8, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Wu further teaches the dynamic operational data collection plan includes additional parameters based on the determined risk level (Wu: [0033]; configured to determine one or more additional data collection rules based on the de-allocation. For example, the additional data collection rule may specify to only collect metadata associated with the device 202 as the amount of data that may he collected is limited, and the metadata associated with the device 202 is more important for analysis than usage and/or user information.
[0037]; performed by the data collection and analysis engine 308. The criteria may include one or more triggers…The software events may include crashes, errors, warnings, and/or updated data collection patterns, for example. [0039]; determine whether the determined resources and capabilities of the device correspond to the triggers of the criteria for the sealing of the data collection and analysis), wherein the additional parameters are selected from the group consisting of: scope, frequency, and granularity of data collection (Wu: [0068]; In other embodiments, the data collection rules may indicate types of data to be collected, types of operations to be performed on data to be collected, an amount of data to be collected, a time at which data is to be collected, a frequency at which data is to be collected, and/or operating conditions of the computing device under which data is to be collected).
Regarding claim 12, Wu teaches a computer system for automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment (Wu: [0021]; The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time), the computer system comprising: a memory (Wu: [0050]; the computing device 500 may include one or more processors 504 and a system memory 506); and
one or more processors in communication with the memory (Wu: [0050]; the computing device 500 may include one or more processors 504 and a system memory 506), wherein the computer system is configured to perform a method, said method comprising: monitoring, by the one or more processors, one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects (Wu: [0021]; The data collection rules may indicate one or more types of data to be collected, types of operations to be performed on data to be collected, an amount of data to be collected, a time at which the data is to be collected, a frequency at which the data is to be collected, and/or operating conditions of the device 102 under which the data is to be collected, for example. The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
obtaining, by the one or more processors, historical operational data of the technical environment and historical resource data of the technical environment, wherein the historical operational data and the historical resource data were generated by the one or more objects (Wu: [0021]; For example, the telemetry module 108 may receive instructions, which may be a data collection pattern comprised of one or more data collection rules, from the service provider 114. [0024]; the data collection and analysis engine integrated with the application 106 may be employed to collect, analyze, and report application data from the device 102. [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
generating, by the one or more processors, based on the historical operational data and the historical resource data, one or more models to evaluate health states and resource states of the one or more objects (Wu: [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern comprised of one or more data collection rules 216 provided by the service provider 220. [0034]; The telemetry module 306 may provide and/or report the collected and analyzed data to a service provider associated with the application. Upon receipt of the collected and analyzed data, the service provider may efficiently implement processes to address issues); and
generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example).
Wu does not explicitly teach applying, by the one or more processors, the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology;
However, Bingham teaches applying, by the one or more processors, the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line). [0139]; Through this monitoring, activity monitor 315 can detect values of performance metrics, such as CPU usage, memory usage, task assignment counts, task assignment types…detect values of performance metrics, such as CPU usage, memory usage…Activity monitor 315 stores the detected values of performance metrics in activity data store 320 at block 910), wherein
the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line)), wherein the identifying comprises determining a risk level for the at least on object (Bingham: [0172]; In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
obtaining, by the one or more processors, a topology of the technical environment (Bingham: [0102]; In some instances, interface engine accesses a set of values for a given component, and generates and presents a table, list, or graph to illustrate a change in a performance);
utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology (Bingham: [0169]; The presentation of the architecture can include identifying all components and relationships in the architecture or a subset of the components and relationships. The subset can include, e.g., components in a highest level in the architecture or in the highest n levels (e.g., n being 2, 3, 4, etc.). [0171]-[0172]; The performance state can include an overall performance state. The overall performance state can be determined based on a plurality of factors, such as CPU usage, memory usage, task-processing times, task-processing intake numbers, and/or received or transmitted task migrations. In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models (See Bingham: [0017]). In addition, the references (Wu and Bingham) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu and Bingham are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Although, Wu teaches the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example). The modification of Wu and Bingham does not explicitly teach the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment.
Rogers teaches generating, by the one or more processors (Rogers: [0094]; The server system 118 executes (e.g., on one or more processors 52 of the server system 118)), the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Rogers: [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110, [0095]; In general, the event data collected by the entity event collectors 110 is used (e.g., by the server system 118) to generate entity relationship information indicating entities 8 and relationships between entities 8. In one example, the entity relationship information includes an entity relationship graph 162. [0122]; how the entity relationship graph 162 stored in the graph database 140 is logically organized (e.g., with nodes 10 representing entities 8 of the computer environment, edges 11 between the nodes 10 representing relationships between the entities 8 represented by the nodes 10), wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level (Rogers: [0014]-[0015]; Examples of such data collection include monitoring log files, listening on event queues for events generated by various technologies and data sources, or pulling information from existing systems in the computer environment that are already aggregating data from multiple sources…proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0027]; Calculation of the risk scores can recur c based on an evaluation frequency associated with each risk object. The resulting scores are stored for future reference and/or time series or trending analyses. In one example, each of the resulting scores for each calculation is stored for each risk object as a node in the risk hierarchy with an edge connecting the risk score node to the risk object node. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110);
automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment (Rogers: [0015]; proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110,
[0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
deploying, by the one or more processors, the command files to the technical environment (Rogers: [0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the further teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment). One of ordinary skill in the art would have been motivated to make such a combination of establish a mechanism to have a current accurate model of entities in a computing environment in such to mitigate the attributes among the entities to provide better performance for the computing environment (See Rogers: [0318]). In addition, the references (Wu, Bingham, and Rogers) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, and Rogers are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Regarding claim 13, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Wu further teaches the resource aware dynamic operational data collection comprises elements selected from the group consisting of: dynamic profiles, dynamic configuration files, dynamic scripts, and dynamic parameters (Wu: [0012]; The telemetry module may also include various specialized components configured to dynamically scale data collection and analysis performed by the data collection and analysis engine for a target device. For example, a scaling profile manager may be configured to receive a profile for a device on which the application is being executed from the service. The scaling profile manager may be further configured to determine one or more resources and capabilities of the device, compare the determined resources and capabilities to the criteria of the profile, and scale the data collection and analysis to be performed by the data collection and analysis engine based on the comparison. Scaling may include adjusting parameters of the data collection and analysis such that the parameters correspond to the resources and capabilities of the device).
Regarding claim 14, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Wu further teaches the models are selected from the group consisting of: health models and resource models (Bingham: [0102]; an interface engine 375 that enables a reviewer 115 to request a performance report and/or receive a performance report. The report can include one or more statistics, states, and/or alarm statuses. The report can identify which component and/or time period are associated with the statistic, state and/or alarm status. Interface engine 375 can present most-recent or substantially real-time values (e.g., numerical statistics or states) and/or historical values).
Regarding claim 16, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, and Bingham further teaches identifying the at least one object of the one or more objects as abnormal comprises determining that the at least one object is operating outside of expected parameters of a model of the one or more models (Bingham: [0092]-[0093]; A statistics generator 340 can access the collection of performance metrics and generate one or more performance statistics based on the values of one or more performance metrics. A performance statistic can pertain to any of the various types of performance metrics, such as a CPU usage, a memory usage, assigned tasks, a task-completion duration, etc…use the state criteria and the generated statistic to assign a state (e.g., to a component and/or time period). [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line)).
Regarding claim 20, Wu teaches a computer program product for automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment (Wu: [0016]; Some embodiments may be implemented as a computer-implemented process (method), a computing system, or as an article of manufacture, such as a computer program product or computer readable media. The computer program product may be a computer storage medium readable by a computer system and encoding a computer program that comprises instructions. [0021]; The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time), the computer program product comprising: one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media readable by at least one processing circuit to perform a method comprising (Wu: [0051]; Depending on the desired configuration, the processor 504 may be of any type, including but not limited to a microprocessor (μP), a microcontroller (μC), a digital signal processor (DSP), or any combination thereof. [0054]; The system memory 506, the removable storage devices 536 and the non-removable storage devices 538 are examples of computer storage media): monitoring, by the one or more processors, one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects (Wu: [0021]; The data collection rules may indicate one or more types of data to be collected, types of operations to be performed on data to be collected, an amount of data to be collected, a time at which the data is to be collected, a frequency at which the data is to be collected, and/or operating conditions of the device 102 under which the data is to be collected, for example. The data collection and analysis engine may collect and analyze data of the application 106 according to the data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
obtaining, by the one or more processors, historical operational data of the technical environment and historical resource data of the technical environment (Wu: [0021]; For example, the telemetry module 108 may receive instructions, which may be a data collection pattern comprised of one or more data collection rules, from the service provider 114. [0024]; the data collection and analysis engine integrated with the application 106 may be employed to collect, analyze, and report application data from the device 102. [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time), wherein
the historical operational data and the historical resource data were generated by the one or more objects (Wu: [0021]; For example, the telemetry module 108 may receive instructions, which may be a data collection pattern comprised of one or more data collection rules, from the service provider 114. [0024]; the data collection and analysis engine integrated with the application 106 may be employed to collect, analyze, and report application data from the device 102. [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern. [0069]; The telemetry module may further include a telemetry transport component configured to receive the data collection pattern. The telemetry module may further include a resource monitor configured to monitor the resources and capabilities of the computing device in real-time);
generating, by the one or more processors, based on the historical operational data and the historical resource data, one or more models to evaluate health states and resource states of the one or more objects (Wu: [0027]; Data including log data, event data, performance data, and state data associated with the application 204, may be collected based on a data collection pattern comprised of one or more data collection rules 216 provided by the service provider 220. [0034]; The telemetry module 306 may provide and/or report the collected and analyzed data to a service provider associated with the application. Upon receipt of the collected and analyzed data, the service provider may efficiently implement processes to address issues);
generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example).
Wu does not explicitly teach applying, by the one or more processors, the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology; objects.
However, Bingham teaches applying, by the one or more processors, the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line). [0139]; Through this monitoring, activity monitor 315 can detect values of performance metrics, such as CPU usage, memory usage, task assignment counts, task assignment types…detect values of performance metrics, such as CPU usage, memory usage…Activity monitor 315 stores the detected values of performance metrics in activity data store 320 at block 910), wherein
the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states (Bingham: [0074]; Tasks can further or alternatively include parsing collected data into individual data events, identifying a time stamp for each data event…storing time stamped data events in a time-series data store. [0127]; A historical-host-performance section shows how a performance statistic has been changing over time. In the depicted instance, the historical statistics (which can include a final real-time statistic) are shown graphically, along with a “normal” threshold (shown as the bottom, dark dashed line) and a “critical” threshold (shown as the top, gray dashed line), wherein the identifying comprises determining a risk level for the at least an object (Bingham: [0172]; In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
obtaining, by the one or more processors, a topology of the technical environment (Bingham: [0102]; In some instances, interface engine accesses a set of values for a given component, and generates and presents a table, list, or graph to illustrate a change in a performance);
utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology (Bingham: [0169]; The presentation of the architecture can include identifying all components and relationships in the architecture or a subset of the components and relationships. The subset can include, e.g., components in a highest level in the architecture or in the highest n levels (e.g., n being 2, 3, 4, etc.). [0171]-[0172]; The performance state can include an overall performance state. The overall performance state can be determined based on a plurality of factors, such as CPU usage, memory usage, task-processing times, task-processing intake numbers, and/or received or transmitted task migrations. In one instance, a single family tree is shown to represent the architecture, and each node can have a graphical element (e.g., a line width, line color, shading, icon presence, etc.) that represents a state for one performance factor. Thus, e.g., by looking at line width, a reviewer 125 could evaluate CPU-usage performances, and, by looking at line color, reviewer 125 could evaluate memory-usage performances);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models (See Bingham: [0017]). In addition, the references (Wu and Bingham) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu and Bingham are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Although, Wu teaches the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Wu: [0024]; As a result, dynamic modification of the data collection pattern may enable optimized performance of data collection without negatively impacting other operations executed by the target device by controlling what types of data to collect, types of operations to be performed on data to be collected, how much data to collect, and how often to collect the data, for example). The modification of Wu and Bingham does not explicitly teach the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment.
Rogers teaches generating, by the one or more processors (Rogers: [0094]; The server system 118 executes (e.g., on one or more processors 52 of the server system 118)), the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects (Rogers: [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110, [0095]; In general, the event data collected by the entity event collectors 110 is used (e.g., by the server system 118) to generate entity relationship information indicating entities 8 and relationships between entities 8. In one example, the entity relationship information includes an entity relationship graph 162. [0122]; how the entity relationship graph 162 stored in the graph database 140 is logically organized (e.g., with nodes 10 representing entities 8 of the computer environment, edges 11 between the nodes 10 representing relationships between the entities 8 represented by the nodes 10), wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level (Rogers: [0014]-[0015]; Examples of such data collection include monitoring log files, listening on event queues for events generated by various technologies and data sources, or pulling information from existing systems in the computer environment that are already aggregating data from multiple sources…proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0027]; Calculation of the risk scores can recur c based on an evaluation frequency associated with each risk object. The resulting scores are stored for future reference and/or time series or trending analyses. In one example, each of the resulting scores for each calculation is stored for each risk object as a node in the risk hierarchy with an edge connecting the risk score node to the risk object node. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110);
automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment (Rogers: [0015]; proactive data collection and enrichment driven by configurable rules and workflows that are responsive to the discovery of new entities, changes to existing entities, and specifics about the entities' attributes. Proactive data collection can also be triggered by timers or manual invocation by users. [0098]; The tracking and remediation subsystem 116 also induces various enrichment and/or remediation processes with respect to the entity relationship information and the computer environment 5 (e.g., supplementing, correcting, or updating the entity relationship information, effecting changes to the computer environment 5, effecting changes in other external environments) via the entity event collectors 110,
[0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
deploying, by the one or more processors, the command files to the technical environment (Rogers: [0181]; Other actions might be intended to employ a program, script or workflow executed as the result of a rule being triggered to perform automated activities to manipulate entities 8 to bring them, or the overall environment 5, into compliance with some desired state. [0183]; A rule could be created where the condition detects any entities of type ComputeNode which have a relationship path to the corresponding entity of type NetworkSubnet representing the specific subnet in question, and where the ComputeNode entity also does not have an attribute (or relationship, depending on how it is modeled) indicating the presence of the desired endpoint security agent. When this condition is triggered the corresponding action could be to execute an Ansible, or some other, script designed to install the desired endpoint agent. Any conceivable fully automated or human involved process could be substituted into this example);
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the further teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment). One of ordinary skill in the art would have been motivated to make such a combination of establish a mechanism to have a current accurate model of entities in a computing environment in such to mitigate the attributes among the entities to provide better performance for the computing environment (See Rogers: [0318]). In addition, the references (Wu, Bingham, and Rogers) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, and Rogers are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Claims 4, 11, 15, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over U.S Patent Application Publication 2017/0052831 issued to Wu et al. (hereinafter as "Wu") in view of U.S Patent Application Publication 2018/0307734 issued to Bingham et al. (hereinafter as "Bingham") in view of U.S Patent Application Publication 2021/0352099 issued to Kenneth Allen Rogers (hereinafter as "Rogers") in further view of U.S Patent Application Publication 2016/0349716 issued to SLESSMAN et al. (hereinafter as "SLESSMAN").
Regarding claim 4, the modification of Wu, Bingham, Rogers teaches claimed invention substantially as claimed, however the modification of Wu, Bingham, and Rogers does not explicitly teach the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint.
Slessman teaches the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint (Slessman: [0123]; DCICS 105 can determine potential alternative data center assets based on one or more of the following: asset utilization, utilization forecasts, physical security, logical security, current latency; utility costs; power capacity or availability, power utilization effectiveness, cooling capability, physical space, network providers, network bandwidth, network redundancy and power redundancy).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment) with the further teachings of Slessman (teaches the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models in improving the system security (See Slessman: [0109]). In addition, the references (Wu, Bingham, Rogers, and Slessman) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, Rogers, and Slessman are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Regarding claim 11, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, however the modification of Wu, Bingham, and Rogers does not explicitly teach automatically implementing, by the one or more processors, the command filed in the technical environment.
Slessman teaches automatically implementing, by the one or more processors, the command filed in the technical environment (Slessman: [0094]; In various embodiments, the control instruction may include machine code instructions, an API call, an electrical signal, a trigger, object code, script, etc. [0145]; Computer programs are configured to enable online and automated functions such as, for example, sending and receiving messages, receiving query requests, configuring responses, dynamically configuring user interfaces, requesting data, sending control instructions, receiving data).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment) with the further teachings of Slessman (teaches automatically implementing, by the one or more processors, the command filed in the technical environment). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models in improving the system security (See Slessman: [0109]). In addition, the references (Wu, Bingham, Rogers, and Slessman) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, Rogers, and Slessman are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Regarding claim 15, the modification of Wu, Bingham, and Rogers teaches claimed invention substantially as claimed, however the modification of Wu, Bingham, and Rogers does not explicitly teach the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint.
Slessman teaches the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint (Slessman: [0123]; DCICS 105 can determine potential alternative data center assets based on one or more of the following: asset utilization, utilization forecasts, physical security, logical security, current latency; utility costs; power capacity or availability, power utilization effectiveness, cooling capability, physical space, network providers, network bandwidth, network redundancy and power redundancy).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment) with the further teachings of Slessman (teaches the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models in improving the system security (See Slessman: [0109]). In addition, the references (Wu, Bingham, Rogers, and Slessman) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, Rogers, and Slessman are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Regarding claim 19, the modification of Wu, Bingham, and Rogers teaches the claimed invention substantially as claimed, however the modification of Wu, Bingham, and Rogers does not explicitly teach automatically implementing, by the one or more processors, the command files in the technical environment.
Slessman teaches automatically implementing, by the one or more processors, the command files in the technical environment (Slessman: [0094]; In various embodiments, the control instruction may include machine code instructions, an API call, an electrical signal, a trigger, object code, script, etc. [0145]; Computer programs are configured to enable online and automated functions such as, for example, sending and receiving messages, receiving query requests, configuring responses, dynamically configuring user interfaces, requesting data, sending control instructions, receiving data).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the invention, to modify Wu (teaches automatically generating and implementing a resource aware dynamic operational data collection and analysis plan in a technical environment…monitoring…one or more objects comprising the technical environment, to collect real-time operational data of the one or more objects…generating, by the one or more processors, the resource aware dynamic operational data collection plan based on the identified subset of the one or more) with the teachings of Bingham (teaches applying…the models to the real-time operational data of the one or more objects to determine health states and resource states for the one or more objects, wherein the applying comprises identifying at least one object of the one or more objects as abnormal based on the health states or the resource states; obtaining, by the one or more processors, a topology of the technical environment; utilizing, by the one or more processors, the topology to identify a subset of the one or more objects which are impacted by the at least one object based on the topology) with the teachings of Rogers (teaches…the resource aware dynamic operational data collection plan based on the identified subset of the one or more objects, wherein the resource dynamic operational data collection plan comprises a parameter designating one or more resources of the technical environment for use in data collection based on the determined risk level; automatically generating, by the one or more processors, based on the resource aware dynamic operational data collection plan, command files to implement the resource aware dynamic operational data collection plan within the technical environment; deploying, by the one or more processors, the command files to the technical environment) with the further teachings of Slessman (teaches the real-time operational data, the historical operational data, and the historical resource data are selected from the group consisting of power, bandwidth, space, computing, cost, and carbon footprint). One of ordinary skill in the art would have been motivated to make such a combination of understanding the user query and providing relevant information by improving the training and operation of the computation models in improving the system security (See Slessman: [0109]). In addition, the references (Wu, Bingham, Rogers, and Slessman) teach features that are directed to analogous art and they are directed to the same field of endeavor as Wu, Bingham, Rogers, and Slessman are directed to data collecting and seeking opportunities to achieve computation results more efficiently.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
U.S Patent Application Publication 2022/0413931 issued to CHIANG et al. (hereinafter as “CHIANG”) teaches collecting operational data from the operation of the resource and determining a configuration to allocate resource based on the future operational data value.
U.S Patent 11,657,309 issued to Stephen Dodson (hereinafter as “Dodson”) teaches analyzing behavior of a computer infrastructure and displaying the behavior of the computer infrastructure in a graphical manner.
U.S Patent Application Publication 2021/0133369 issued to Cader et al. (hereinafter as “Cader”) teaches monitoring and maintaining computer systems and identify anomalous behavior within collective system.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ANDREW N HO whose telephone number is (571)270-0590. The examiner can normally be reached Tuesday and Thursday 10:00-6:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sherief Badawi can be reached at (571) 272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
1/16/2026
/ANDREW N HO/Examiner
Art Unit 2169
/SHERIEF BADAWI/Supervisory Patent Examiner, Art Unit 2169