DETAILED ACTION
This Office Action is in response to the amendment filed on 10/16/2025 in which claims 1-20 are presented for examination on the merits.
Notice of Pre-AIA or AIA Status
The present application is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
1. Applicant's arguments in pages 5-8 of the REMARKS filed on 10/16/2025 with respect to the rejection under 35 USC § 103(a) are acknowledged. With regards to the rejection under 35 U.S.C. § 101, Applicants arguments in light of the claim amendments have been considered. As such, the Examiner hereby withdraws the rejection under 35 U.S.C § 101.
2. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“..Thus, Applicant claims accessing log data describing user activity, generating one or more alerts from that log data and initiating a workflow to acknowledge the alerts based on the alerts.1 Claim 11 recites similar limitations. The claim flow (user activity to alert generation to user-acknowledgement workflow) defines a self-referential feedback mechanism. Neither Pon nor Gill, alone or in combination, teach or suggest a comparable mechanism..”
The argument is not persuasive. In response to applicant's argument that the reference does not show certain features of applicant’s invention, it is noted that the features upon which applicant relies (i.e., …. a self-referential feedback mechanism… a comparable mechanism) are not recited in the rejected independent claims 1 and 17. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Pon clearly teaches the elements of the aforesaid claims i.e. log data based alert generation/acknowledgement that initiates a workflow (Pon, Claim 16, Para 0005: initiating a mitigation workflow responsive to the alert …..associated with a specific event in the inventory i.e. log wherein a notification/report i.e. acknowledgement is received by the user).
Further, Pon teaches that an alert/warning is generated based on the gathered data (i.e. log data) where a confirm or dismiss button is presented for user input/acknowledgment associated with a command to initiate a mitigation workflow (Para 0051-0056, Para 0064, 0066).
Thus, the aforesaid teachings in Pon leaves no ambiguity that a workflow is initiated based on the log data alert generation/acknowledgement.
3. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“..Thus, Pon does not disclose or suggest an operation in which a user receives an alert and can acknowledge the alert before further action occurs. According to In re Keller,2 a reference may not be combined for a feature that it does not teach…..neither reference teaches or suggests the dependencies of the independent claims where the alert is the trigger condition for a workflow explicitly acknowledging the alert. Accordingly, no combination of Pon and Gill can teach or suggest the limitations of the independent claims…..Finally, assuming, arguendo, Pon and Gill are properly combined, the result would be two unrelated alert channels, not a unified log-to-alert-to-acknowledgement workflow. Accordingly, no combination of the cited reference can render the claims obvious..”
The Examiner respectfully submits that Pon et al. does not change the principle of operation of the secondary reference or render the reference inoperable for its intended purpose. See MPEP § 2143.01. The test for obviousness is not whether the features of a secondary reference may be bodily incorporated into the structure of the primary reference Pon. Rather, the test is what the combined teachings of those references would have suggested to those of ordinary skill in the art.” In re Keller, 642 F.2d 413, 425, 208 USPQ 871, 881 (CCPA 1981). See also In re Sneed, 710 F.2d 1544, 1550, 218 USPQ 385, 389 (Fed. Cir. 1983). It is not necessary that the inventions of the references be physically combinable to render obvious the invention under review.”; and In re Nievelt, 482 F.2d 965, 179 USPQ 224, 226 (CCPA 1973).
Combining the teachings of references Pon and Gill does not involve an ability to combine their specific structures. Thus, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). Therefore, prior arts must be considered in entirely, including discloses that teach away from the claims, MPEP § 2143.01-02.
The “mere existence of differences between the prior art and an invention does not establish the invention’s nonobviousness.” Dann v. Johnston, 425 U.S. 219, 230, 189 USPQ 257, 261 (1976). The gap between the prior art and the claimed invention may not be “so great as to render the [claim] nonobvious to one reasonably skilled in the art.” Id. MPEP 2141 (section III).
In view of the above, it would have been obvious to the skilled artisan to modify the teachings of Pon with the teachings of Gill to perform the functions of the method as claimed including generating, based on the log data, one or more alerts; and initiating, based on the one or more alerts, a workflow to acknowledge the one or more alerts by the user.
Accordingly, the claimed invention as a whole was at least prima facie obvious, if not anticipated by the reference, especially in the absence of sufficient, clear, and convincing evidence to the contrary.
4. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“…Moreover, the workflow of Gill is system-driven and not user-acknowledged, as recited in the claims. More specifically, Gill does not teach or suggest a user receiving an alert prior to workflow execution with the ability to affirmatively acknowledge the alert, nor does Gill teach or suggest generating alerts from log data describing the user's activity. “
After careful review, the Examiner respectfully disagrees and notes that nowhere the independent claim recites “a user receiving an alert prior to workflow execution with the ability to affirmatively” acknowledge. The claim limitations simply recite log data based alert generation and user acknowledgement that initiates a workflow. As stated above Pon clearly discloses the elements of the claim (Pon, Para 0051-0056, Para 0064, 0066 Claim 16: initiate a mitigation workflow for resolution of the event until resolution occurs based on the alert/warning generated from gathered/inventory data (i.e. log data). A confirm or dismiss button is presented for user input/acknowledgment associated with a command to initiate a mitigation workflow).
Further, Gill discloses a Log Management System and Alert Enterprise System where Alert is generated based on user log data enabling users to view and analyze data for acknowledgment in a security and risk management context by providing a visual analytics and by initiating the workflow processes and business intelligence and remedial action (See, Gill, Para 0168, 0289, 0463 and Para 0575 (TABLE-US-00002 TABLE B 2.1).
As is clearly evident from the above explicit teachings, even if the claimed language is not identical to that disclosed by the cited references, the differences between that which is disclosed and that which is claimed are considered to be so slight (i.e. predictable variance, KSR, MPEP 2143) that it would have been obvious to the skilled artisan to modify the teachings of Pon and Gill as a design preference and make the invention as claimed especially when each feature and function of the claimed invention is present in the references.
The Applicant has failed to clearly explain the pertinence of each cited passage, by failing to clearly articulate the difference between claim features and specification, with a convincing rationale and factual support.
As is readily evident, the claimed invention as a whole was at least prima facie obvious, if not anticipated by the reference, especially in the absence of sufficient, clear, and convincing evidence to the contrary.
In view of the above teachings in Pon and Gill, it would have been obvious to one of ordinary skilled in the art before the effective filing of the claimed invention to generate, based on the log data, one or more alerts; and initiating, based on the one or more alerts, a workflow to acknowledge the one or more alerts by the user, because such a modification would have been considered a mere configuration preference, and thus, would have been obvious to try.
5. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“…The Office Action appears to treat the terms "alert" and "workflow" as generic concepts that are interchangeable across any system. According to In re Fritch,3 such generalizations are improper when the reference employs those terms in different contexts and for different purposes. In the current set of references, Pon uses "alert" to indicate a system asset anomaly and Gill uses "alert" to indicate a compliance or access violation. In contrast, the current claims generate an alert from user activity logs, and the alert is used to trigger a workflow with user acknowledgement. The treatment of the term "workflow" suffers from the same treatment. Thus, the references cannot be used in the manner proposed in the Office Action.. “
Applicant’s reliance on In re Fritch, 972 F.2d 1260 (Fed. Cir. 1992), is not persuasive. Fritch does not prohibit reasonable abstraction or functional interpretation of disclosed elements; rather, it precludes reliance on unsupported speculation where a reference lacks a teaching of the claimed feature. Here, the cited references expressly disclose alerts generated from recorded/logged activity and workflows that respond to such alert acknowledgement. The Office Action relies on these express teachings as reasonably interpreted in view of the knowledge and creativity of a person of ordinary skill in the art, consistent with MPEP §§2141 and 2111, and does not improperly reconstruct the claims.
Applicant’s argument that the references use “alert” and “workflow” in different contexts is likewise unavailing. Obviousness does not require identical purposes or terminology. KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 417–18 (2007). Alerts/warning notifications are well-understood functional constructs used to signal events requiring sequence of actions, and workflows are conventional mechanisms for handling such events, including acknowledgment and follow-up actions. A person of ordinary skill in the art would have been motivated to apply known workflow handling to alerts derived from user activity logs to initiate mitigation actions and improve efficiency and accountability—representing a predictable use of prior art elements according to their established functions (MPEP §2143).
Finally, Applicant’s assertion that the combination would yield only “unrelated alert channels” improperly limits what a person of ordinary skill in the art would reasonably infer. The Supreme Court has rejected rigid requirements that references must explicitly disclose the claimed combination. KSR, 550 U.S. at 418. Integrating alerts into a unified workflow is a routine and expected design choice in data security monitoring and/or remediation services and would have been obvious to try with a reasonable expectation of success. Perfect Web Techs., Inc. v. InfoUSA, Inc., 587 F.3d 1324, 1329 (Fed. Cir. 2009). Accordingly, the rejection under 35 U.S.C. §103 is maintained.
6. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“…Claims 2 and 12 recite determining whether to initiate a workflow by comparing alerts to policies. The policies disclosed by Pon determine what to scan, not whether to launch a user workflow. The policies disclosed by Gill govern access rights, not alert comparison. Thus, no combination of the references can teach or suggest the limitations of claims 2 and 12... “
The Examiner respectfully disagrees and notes that Pon clearly relates/compares alerts to policies (See, Para 0057, 0063, Claim 16: generating alerts based in listed policies and a message/notification is sent to the user to confirm or dismiss the alert so a mitigation workflow can be initiated).
As is readily evident, the claimed invention as a whole was at least prima facie obvious, if not anticipated by the reference, especially in the absence of sufficient, clear, and convincing evidence to the contrary.
7. Regarding claim amendments corresponding to the rejection under 35 U.S.C. 103(a), applicant argues, for example:
“…Claims 3-5 and 13-25 specify the source and type of log data. Neither Pon nor Gill teach or suggest use of user activity logs. Thus, no combination of the references can teach or suggest the limitations of claims 3-5 and 13-15.... “
The argument is not persuasive. Gill clearly discloses user activity logs are associated with services like SaaS, web services, and identity service providers (Gill, Claim 8, Para 0201, 0536: continuously monitoring activity logs, alerting, enforcing policies, and initiating a workflow for remediation; Para 0196: SaaS; Para 0432: identity and access management systems as well as GRC and directory service provider).
Further Gill discloses a Log Management System and Alert Enterprise System where Alert is generated based on user log data enabling users to view and analyze data for acknowledgment in a security and risk management context by providing a visual analytics and by initiating the workflow processes and business intelligence and remedial action (See Gill, Para 0168, 0289, 0463 and Para 0575 (TABLE-US-00002 TABLE B 2.1).
The Applicant has failed to clearly explain the pertinence of each cited passage by failing to articulate, with a convincing rationale and factual support, the distinction between the claimed features and the disclosure of the specification.
In view of the above teachings in Pon and Gill, it would have been obvious to one of ordinary skilled in the art to implement a unified log-to-alert-to-acknowledgement workflow for mitigation an alert event, because such a modification would have been considered a mere configuration preference and, therefore, obvious to try.
Claim Rejections - 35 USC § 103
8. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
9. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
10. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
11. This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
12. Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Pon et al. (US 20160112284 A1, hereinafter, Pon) in view of Gill et al. (US 20120224057 A1, hereinafter, Gill).
Regarding claim 1, Pon discloses a method of offline workflows in an edge-based data platform (Para 0057: generate an alert or a report for when the details when a web server goes offline), the method comprising:
[accessing log data describing activity associated with a user] (Para 0005, 0063, 0066: policy-based scans is performed wherein user receives a notification/report when information for an asset in inventory changes or when a specific event occurs);
generating, based on the log data, one or more alerts (Para 0056-0057: generate alerts or reports based on the periodic scans performed on entries in an inventory list…. when an alert is triggered, an icon (e.g., the warning icon 318) displayed by a GUI generated by the discovery and inventory application 109); and
initiating, based on the one or more alerts, a workflow to acknowledge the one or more alerts by the user (Para 0064-0065: when the user 502 confirms the alert, the discovery and inventory application 504 may initiate a mitigation workflow, at 530. For example, if the alert is for phishing, initiating the mitigation workflow may include contacting a third-party takedown service)
Pon does not explicitly states but Gill from the same or similar fields of endeavor teaches accessing log data describing activity associated with a user (Gill, Para 0261, 0273, 0391: users Activity and access log.. continuously monitor super-user activity and enforce policies).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have the categories of vulnerabilities, initiate ingesting the information sources, and view the extracted configuration information as taught by Hering in the teachings of Gates for the advantage of providing complete solutions for role-based, rules-driven access enforcement, the techniques including situational awareness and addressing blended risk assessment and security across logical systems (Gill, Abstract).
Regarding claim 2, the combination of Pon and Gill discloses the method of claim 1, wherein initiating the workflow comprises determining whether to initiate the workflow by comparing the one or more alerts to one or more policies (Pon Para 0057, 0062-0063: GUI includes a list 404 of options which policies the discovery and inventory application 109 will use to generate alerts).
Regarding claim 3, the combination of Pon and Gill discloses the method of claim 1, wherein the log data is accessed from one or more services accessible to the user (Pon Para 0030, 0047: the discovery and inventory application 109 may invoke a software or service that receives the seed as input and returns a list of domains).
Regarding claim 4, the combination of Pon and Gill discloses the method of claim 3, wherein the log data comprises Software-as-a-Service (SaaS) application logs (Gill Para 0162: attaching alert enterprise system 100 to SAAS systems).
Regarding claim 5, the combination of Pon and Gill discloses the method of claim 3, wherein the log data comprises identity provider (IdP) logs (Gill, Para 0300: an AlertInsight subsystem contains a visual mapping and remediation layer 802, a data aggregation and continuous monitoring layer which includes ERP systems, Identity and Access Management (IAM) Provisioning and Roles Management systems).
Regarding claim 6, the combination of Pon and Gill discloses the method of claim 1, further comprising controlling access by the user to one or more resources until completion of the workflow (Gill Para 0387, 0548-0549: an AlertMonitor subsystem 408 that provides the ability to give administrators or technicians, highly privileged access for pre-set duration to conduct emergency response to incidents presently occurring. During this special access period all tasks are monitored, analyzed and logged ensuring complete visibility and transparency).
Regarding claim 7, the combination of Pon and Gill discloses the method of claim 1, further comprising: determining that the workflow was not completed; and providing a notification to another user indicating that the workflow was not completed (Pon, Para 0064: initiating the mitigation workflow includes contacting a third-party takedown service and providing details regarding the internet-facing asset to the third-party ).
Regarding claim 8, the combination of Pon and Gill discloses the method of claim 7, wherein determining that the workflow was not completed comprises determining that the workflow was not completed within a time window after initiating the workflow (Gill Para 0582, 0387: list of users who have accessed a particular facility during a certain period of time…. AlertMonitor subsystem 408 that provides the ability to give administrators or technicians, highly privileged access for pre-set duration to conduct emergency response to incidents presently occurring. During this special access period all tasks are monitored, analyzed and logged ensuring complete visibility and transparency).
Regarding claim 9, the combination of Pon and Gill discloses the method of claim 1, further comprising applying, to a user account associated with the user, one or more tags based on the one or more alerts (Gill Para 0462: set up as smart tags in the software)
Regarding claim 10, the combination of Pon and Gill discloses the method of claim 1, wherein the workflow requires reauthentication by the user (Pon, Para 0077: verifying that the crawl configuration includes necessary username/password information, etc.).
Regarding claim 11; Claim 11 is similar in scope to claim 1, and is therefore rejected under similar rationale.
Regarding claim 12; Claim 12 is similar in scope to claim 2, and is therefore rejected under similar rationale.
Regarding claim 13; Claim 13 is similar in scope to claim 3, and is therefore rejected under similar rationale.
Regarding claim 14; Claim 14 is similar in scope to claim 4, and is therefore rejected under similar rationale.
Regarding claim 15; Claim 15 is similar in scope to claim 5, and is therefore rejected under similar rationale.
Regarding claim 16, Claim 16 is similar in scope to claim 6, and is therefore rejected under similar rationale.
Regarding claim 17; Claim 17 is similar in scope to claim 7, and is therefore rejected under similar rationale.
Regarding claim 18; Claim 18 is similar in scope to claim 8, and is therefore rejected under similar rationale.
Regarding claim 19; Claim 19 is similar in scope to claim 9, and is therefore rejected under similar rationale.
Regarding claim 20; Claim 20 is similar in scope to claim 10, and is therefore rejected under similar rationale.
Examiner Notes
13. The Examiner notes that incorporating the combined limitations of claims 2, 6, 9, and 10 or combined limitations of claims 4, 6, 9, and 10 into independent claim 1 would better clarify the subject matter/embodiment of claimed invention. Similarly, amending independent claim 11 with aforesaid claim limitations from similar claims would help advance the prosecution as it would clarify the claimed invention.
Conclusion
14. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Ford et al. (US 20170041296 A1) discloses techniques for managing data for regulated environments wherein data is collected from a plurality of sources; analyzing the data; and providing one or more outputs based on the analysis.
Chin et al. (US 20170085803 A1) discloses a video tracking system includes a user interface configured to facilitate tracking of a target between video cameras. The user interface includes user controls configured to assist a user in selecting video cameras as the target moves between fields of view of the video cameras. .
15. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAHFUZUR RAHMAN whose telephone number is (571)270-7638. The examiner can normally be reached on Monday thru Friday.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached on 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MAHFUZUR RAHMAN/Primary Examiner, Art Unit 2498
Prosecution Insights