DETAILED ACTION
This communication is in response to application number 18/340,371 filed on 07/13/2026. Claims 1-20 are pending examination
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to arguments
Rejections based on 35 U.S.C. § 112(b) or 35 U.S.C. § 112 (pre-AIA )
Applicant’s amendments regarding claims 1-15 and 18-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite have been fully considered and are not persuasive. The request being a basis for a search is insufficient to clarify the usage of the request. Hence, the rejection is maintained.
Rejections based on 35 U.S.C. § 101
Applicant’s amendments regarding claim 11 and 15 have been fully considered and are not persuasive. The amendment uses the results of the first search to perform the second stage search, which provides no improvement and hence the rejection is maintained for the same reasons.
Rejections based on 35 U.S.C. § 103
Applicant’s arguments regarding the rejection of claims 1-20 under 35 U.S.C. 103 have been fully considered and are moot since the amendments have necessitated new grounds of rejection.
A new reference Alayli et al. (US 20200372071 A1) has been introduced to disclose the two-stage search architecture. Alayli first searches compact manifest or index information to identify relevant partitions or block identifiers, then uses those identifiers to limit retrieval and processing to only the corresponding portions of the underlying raw data. Thus, its index or manifest functions as the scoping digest and the selected blocks form the scoped sub portion searched for detailed results.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.-The specification shall conclude with one or more claims particularly pointing
out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the
invention. The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming
the subject matter which the applicant regards as his invention.
Regarding claim 1 recites- "receiving a request for the security posture of the
computing environment,", it is unclear what the request performs. The request is not
used further in the independent or dependent claims. Hence, claim 1 is being rejected
under 35 U.S.C 112(b).
Regarding claim 8 recites- "communicating the request for the security posture",
it is unclear what the request performs. The request is not used further in the
independent or dependent claims. Hence, claim 8 is being rejected under 35 U.S.C
112(b).
Regarding claim 11 recites- "communicating the request for the security
posture", it is unclear what the request performs. The request is not used further in the
independent or dependent claims. Hence, claim 11 is being rejected under 35 U.S.C
112(b).
Regarding claim 11, amended claim recites in the limitation “the raw data".
There is insufficient antecedent basis for this limitation in the claim.
Regarding claim 18 recites "receiving a request for the security posture of the
computing environment;" it is unclear what the request performs. The request is not
used further in the independent or dependent claims. Hence, claim 18 is being rejected
under 35 U.S.C 112(b).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or
composition of matter, or any new and useful improvement thereof, may obtain a patent
therefore, subject to the conditions and requirements of this title.
Claims 11 and 16 are rejected under 35 U.S.C. 101 because the claimed
invention is directed to non-statutory subject matter.
Claim 11 and 16 is rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
According to the published guideline on subject matter eligibility of computer
readable media (OG Notice 1351 OG 212, Feb. 23, 2010), the broadest reasonable
interpretation of a claim drawn to a non-volatile computer-readable medium (also called
machine readable/storage medium and other such variations) typically covers forms of
non-transitory tangible media and transitory propagating signals per se in view of the
ordinary and customary meaning of computer readable media. See MPEP 2111.01,
and as such, claim 11 are rejected under 35 U.S.C. § 101 as covering non-statutory
subject matter. Applicant's specification in paragraph [0066] does not have an "explicit
definition" set forth to exclude the transitory signal embodiment from the scope of the
claimed "a computer- storage media". A claim drawn to such a computer-storage media
may be amended to narrow the claim to cover only statutory embodiments to avoid a
rejection under 35 U.S.C. § 101 by adding the limitation "non-transitory" to the in
the claim.
Independent claim
Step 1:
Claims 11 and 16 are drawn to a method, therefore falls under one of four
categories of statutory subject matter (process/method, machines/products/apparatus
manufactures, and compositions of matter).
Step 2A, Prong 1:
Nonetheless, claims 11 and 16 are directed to a judicially recognized exception
of an abstract idea without significantly more. Claim 11 and 16 recites a method of "a
request for a security posture of a computing environment", "receiving a security
posture visualization associated with the computing environment", enumerates a mental
concept. This is merely a display, akin to a pen and paper method of a person thinking
about a security posture. Claim 16 is similarly a person thinking about security posture
and includes a "deploying". Deploying may reasonably be interpreted as storing data, or
writing it down using pen and paper, as no technical details of a deployment are
claimed. As such, these steps are nothing more than an abstract mental concept
(MPEP 2106.04(a)(2)(III)).
Step 2A, Prong 2:
Claims 11 and 16 recites additional step of "causing display of the security
posture visualization comprising the summary entity" and "the security data digest is
associated with a two-stage search" that fails to integrate the abstract idea into a
practical application. This is simply a visualization comprising an entity which is a form
of information presentation without any specific technological improvement. The two-
staged search is merely humans reviewing summaries and deciding what to inspect
next without requiring a particular machine implementation. This additional step of
causing display and performing a search, is a form of insignificant extra solution activity
where a display for the purpose of conveying information is necessary for all uses of the
judicial exception. The additional steps fails to integrate the abstract idea into a practical
application because it does not impose any meaningful limits on practicing the abstract
idea (MPEP 2106.05(g)) (MPEP 2106.05(g)).
Step 2B:
The additional step that is a form of insignificant extra-solution activity, does not
amount to significantly more than an abstract idea because the courts have recognized
that this additional step to be well-understood, routine, and conventional when claimed
in a merely generic manner for a method for thinking about a security posture (See
MPEP 2106.05(d)(II)(i)). As such claims 11 and 16 is not patent eligible.
Dependent claims
Dependent claims 12-14, 17-20 are ineligible for the same reasons given with
respect to claims 11, 16.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6,8,10-13 and 15-19 are rejected under 35 U.S.C. 103 as being unpatentable over Noel et al. (US 20170289187 A1), hereinafter referred to as Noel in view of Ross et al. (US 20210342441 A1), hereinafter referred to as Ross in further view of Alayli et al. (US 20200372071 A1), hereinafter referred to as Alayli
As per claim 1, Noel discloses a computerized system comprising:
one or more computer processors; and (One or more of processor 1110, Noel, para [0071])
computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operations comprising: (Storage 1140 such as RAM, Noel, para [0073])
accessing raw data associated with security posture management of a computing environment; (Receive data from the one or more network sensors and convert the received data to a common format, Noel, claim 1)
based on the raw data, generating a security data digest comprising a plurality of summary entities of the raw data that operate as a scoping-index of the raw data, wherein the security data digest is associated with a two-stage search that includes: (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006, Noel, para [0068]. Generating higher-level summary graph entities from raw data).
using the security data digest, generating a security posture visualization associated with the computing environment, wherein the security posture visualization comprises a summary entity of the security data digest; (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006 that will eventually be converted into nodes and edges of a graph database and system can synthesize information to create an overall visualization of the security posture, Noel, para [0018] and [0068]).
communicating the security posture visualization comprising the summary entity; (The graph model 200 can be ready to be queried by a user of the graph model using a domain-specific query language, Noel, para [0036]. This implies that results are communicated to the users/UI).
receiving an indication to execute a remediation action associated with the summary entity, wherein the remediation action is associated with the security posture visualization; and (The system can correlate intrusion alerts to known vulnerability paths and suggest best courses of action for responding to attacks, Noel, para [0005]).
However, Noel does not explicitly disclose the limitations:
a first search over the security data digest to identify summary entities that contain data of interest; and
a second search over a scoped sub-portion of the raw data to identify detailed query results;
deploying the security data digest associated with generating a security posture of the computing environment;
receiving a request for the security posture of the computing environment;
executing the remediation action
Ross discloses:
deploying the security data digest associated with generating a security posture of the computing environment; (The progressive trigger framework system 122 to include a primary analysis engine 124. The primary analysis engine 124 can be configured to receive structured or unstructured data input (i.e., raw data) from various sources, Ross, para [0045]. The system ingests structured or unstructured raw data and transforms it into higher-level quantities such as detection probability per time period and a trigger indicator of behavior. Those quantities are effectively a security data digest (a summarized, model-based representation of entity behavior) that is deployed in the computing environment to detect malicious entity behavior and provide accurate indicator of behavior which functions as a security posture indicator for entities)
receiving a request for the security posture of the computing environment; (Device 202 may request a particular service, Ross, para [0096]. Accurate indicator of behaviors indicating occurrence of malicious behavior is effectively a security posture indicator for each entity in the computing environment)
executing the remediation action (Breaking or disrupting an opponent's kill chain is a method of defense or preemptive action, Ross, para [0256])
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
However, Noel in view of Ross does not explicitly disclose the limitation:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results;
Alayli discloses:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and (The search service uses the catalog/ index information to identify a list of partitions considered to contain data responsive to the query. The query peer then uses the manifest dictionary to identify search terms and retrieves corresponding posting lists and those lists are intersected to determine the relevant data blocks, Alayli, claim 1. This is the first stage search. The system does not initially search all underlying raw data. It searches compact catalog information to determine which partitions or data blocks potentially contain the requested information. Thus, the identified partitions or block IDs correspond to the summary entities identifying data of interest)
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; (After consulting the index, the posting lists are then intersected to obtain final block identifiers in the data file. The system then requests only the corresponding contiguous byte ranges from the data file, processes those selected raw data blocks, produces partial results and consolidates them into the query response, Alayli, para [0029]. Here, the summary entities via the first search corresponds to the selected block identifiers and the scoped sub portion of the raw data is only the data.hdx.blocks or the byte ranges identified by those block IDs and the processing the retrieved selected data blocks to obtain the actual responsive records aligns with the second search to identify detailed query results)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Alayli by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) with two stage search (Alayli). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel and Ross with Alayli in order to effectively reduce the amount of raw data retrieved and processed thereby improving query efficiency and scalability when generating detailed results (See Alayli, para [0029]).
As per claim 2, Noel, Ross and Alayli disclose the system of claim 1, further comprising
Furthermore, Noel discloses:
causing display of the security posture visualization comprising the summary entity (The system can synthesize information from multiple sources to create an overall visualization of the security posture, Noel, para [0018])
As per claim 3, Noel, Ross and Alayli disclose the system of claim 1, wherein
Furthermore, Ross discloses:
generating the security data digest is based on an aggregation function comprising two or more key summary entities associated with identifying a sub-portion of the raw data for executing security queries, wherein the security data digest is stored in a data exploration service and the raw data is stored as unstructured data in an unstructured data storage (Querying raw data and writing summary data. Structured or unstructured data input (i.e., raw data) from various sources, Ross, para [0045] and [0046]. This step of querying the raw data and writing summary data describes an aggregation function that transforms raw security telemetry into summary entities tied to specific entities and time windows. The model keeps raw data as structured or unstructured raw data input from various sources while separately maintaining summary data, observables and entity state)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 4, Noel, Ross and Alayli disclose the system of claim 1, wherein
Furthermore, Noel discloses:
generating the security data digest comprises using a security data digest model to generate the plurality of summary entities, the plurality of summary entities are generated based on a plurality of summary entity types associated with known security queries of security investigations (The system can correlate intrusion alerts to known vulnerability paths and suggest best courses of action for responding to attacks for maintaining mission readiness. The ingested data parsed so as to provide data to build a multitude of nodes and relationships. Queries can be executed against the graph database model to investigate security incidents, Noel, para [0005], [0066] - [0070]).
As per claim 5, Noel, Ross and Alayli disclose the system of claim 1, further comprising
Furthermore, Ross discloses:
a security data digest model update engine associated with periodically updating the plurality of summary entities, wherein the security data digest model update engine comprises update summary entity types associated with executed search queries and query results on the security data digest and the raw data (Monitoring over time, the raw data input and associating the actions of the entity to particular time periods, Ross, para [0007] and computing detection probability at each time period, then repeatedly querying the raw data and writing observables, writing summary data, writing detection results, Ross, para [0046]. This continuous monitoring and re-writing of observables, summaries and entity state embodies a security data digest model update engine that periodically updates the plurality of summary entities based on executed queries and their results on both raw and summary layers).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 6, Noel, Ross and Alayli disclose the system of claim 1, wherein generating the security posture visualization comprises:
generating a first query result for the security query, wherein the first query result comprises the summary entity; and (The database login (after stealing the password) is essentially indistinguishable from a benign login, and thus has no associated vulnerability or alert, Noel, para [0048]. This is a query result the analyst might suspect that these are potentially multiple attack steps by the same threat actor)
using the first query result, generating the security posture visualization (System 1000 can synthesize information from disparate and varied sources to create an overall visualization of the security posture, Noel, para [0018]).
However, Noel does not explicitly disclose the limitation:
accessing a security query associated with the security data digest;
executing the security query using the security data digest;
Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 8, Noel, Ross and Alayli disclose the system of claim 1, the operations further comprising:
based on the request, receiving the security posture visualization associated with the computing environment, wherein the security posture visualization comprises the summary entity that is associated with the security data digest; and causing display of the security posture visualization comprising the summary entity (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006 that will eventually be converted into nodes and edges of a graph database and system can synthesize information to create an overall visualization of the security posture, Noel, para [0018] and [0068]).
Furthermore, Ross discloses:
communicating the request for the security posture of the computing environment; (Device 202 may request a particular service, Ross, para [0096]. Accurate indicator of behaviors indicating occurrence of malicious behavior is effectively a security posture indicator for each entity in the computing environment).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 10, Noel, Ross and Alayli disclose the system of claim 1, wherein
Furthermore, Noel discloses:
the security posture visualization comprises an alert associated with the summary entity, wherein the alert is associated with a prioritization identifier and the remediation action, wherein the prioritization identifier is based on the summary entity and the remediation action is executable to address a security threat associated with the alert (The cyber threats layer 204 can also include an alert node 204c. Alert node 204c can include information gathered in real-time about the state of a network, such as the type of data gathered by Splunk discussed above. Using Splunk as an example, when Splunk identifies a suspicious pattern of behavior within a network, it can generate an alert that can be represented by an alert node 204c. The pattern of behavior that generated alert 204c can be represented by an edge 204c of the graph model 200 that can contain information related to the pattern that would trigger an alert 204c. The edge 204c can connect nodes 204a and 204c such that the relationship between a particular alert as discovered by data sources such as Splunk can be related back to known cyber-threats as detailed in a classification of cyber-threats, such as CAPEC, Noel, para [0032]).
As per claim 11, Noel discloses one or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising:
based on the request, receiving a security posture visualization associated with the computing environment, wherein the security posture visualization comprises a summary entity of a security data digest, wherein the security data digest is associated with a two-stage search that includes: (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006 that will eventually be converted into nodes and edges of a graph database and system can synthesize information to create an overall visualization of the security posture, Noel, para [0018] and [0068]).
causing display of the security posture visualization comprising the summary entity (The system can synthesize information from multiple sources to create an overall visualization of the security posture, Noel, para [0018]).
However, Noel does not explicitly disclose the limitation:
communicating a request for a security posture of a computing environment;
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and
Ross discloses:
communicating a request for a security posture of a computing environment; (Device 202 may request a particular service, Ross, para [0096]. Accurate indicator of behaviors indicating occurrence of malicious behavior is effectively a security posture indicator for each entity in the computing environment).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
However, Noel in view of Ross does not explicitly disclose the limitations:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and
Alayli discloses:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and (The search service uses the catalog/ index information to identify a list of partitions considered to contain data responsive to the query. The query peer then uses the manifest dictionary to identify search terms and retrieves corresponding posting lists and those lists are intersected to determine the relevant data blocks, Alayli, claim 1. This is the first stage search. The system does not initially search all underlying raw data. It searches compact catalog information to determine which partitions or data blocks potentially contain the requested information. Thus, the identified partitions or block IDs correspond to the summary entities identifying data of interest)
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and (After consulting the index, the posting lists are then intersected to obtain final block identifiers in the data file. The system then requests only the corresponding contiguous byte ranges from the data file, processes those selected raw data blocks, produces partial results and consolidates them into the query response, Alayli, para [0029]. Here, the summary entities via the first search corresponds to the selected block identifiers and the scoped sub portion of the raw data is only the data.hdx.blocks or the byte ranges identified by those block IDs and the processing the retrieved selected data blocks to obtain the actual responsive records aligns with the second search to identify detailed query results)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Alayli by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) with two stage search (Alayli). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel and Ross with Alayli in order to effectively reduce the amount of raw data retrieved and processed thereby improving query efficiency and scalability when generating detailed results (See Alayli, para [0029]).
As per claim 12, Noel, Ross and Alayli discloses the media of claim 11, the operations further comprising:
accessing raw data associated with security posture management of the computing environment; (Receive data from the one or more network sensors and convert the received data to a common format, Noel, claim 1)
based on the raw data, generating the security data digest comprising a plurality of summary entities of the raw data that operate as a scoping-index of the raw data; and (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006, Noel, para [0068]. Generating higher-level summary graph entities from raw data).
Furthermore, Ross discloses:
deploying the security data digest to support generating the security posture of the computing environment (The progressive trigger framework system 122 to include a primary analysis engine 124. The primary analysis engine 124 can be configured to receive structured or unstructured data input (i.e., raw data) from various sources, Ross, para [0045]. The system ingests structured or unstructured raw data and transforms it into higher-level quantities such as detection probability per time period and a trigger indicator of behavior. Those quantities are effectively a security data digest (a summarized, model-based representation of entity behavior) that is deployed in the computing environment to detect malicious entity behavior and provide accurate indicator of behavior which functions as a security posture indicator for entities) .
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 13, Noel, Ross and Alayli disclose the media of claim 11, the operations further comprising:
generating a first query result for security, wherein the first query result comprises the summary entity; and (The database login (after stealing the password) is essentially indistinguishable from a benign login, and thus has no associated vulnerability or alert, Noel, para [0048]. This is a query result the analyst might suspect that these are potentially multiple attack steps by the same threat actor)
using the first query result, generating the security posture visualization (System 1000 can synthesize information from disparate and varied sources to create an overall visualization of the security posture, Noel, para [0018]).
Furthermore, Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 15, Noel, Ross and Alayli disclose the media of claim 11, the operations further comprising:
Furthermore, Noel discloses:
receiving an indication to execute a remediation action associated with the summary entity, wherein the remediation action is associated with the security posture visualization; and (The system can correlate intrusion alerts to known vulnerability paths and suggest best courses of action for responding to attacks, Noel, para [0005]).
communicating the indication to execute the remediation action to cause execution of the remediation action (The graph model 200 can be ready to be queried by a user of the graph model using a domain-specific query language, Noel, para [0036]. This implies that results are communicated to the users/UI).
As per claim 16, Noel discloses a computer-implemented method, the method comprising:
accessing raw data associated with security posture management of a computing environment; (Receive data from the one or more network sensors and convert the received data to a common format, Noel, claim 1)
based on the raw data, generating a security data digest comprising a plurality of summary entities of the raw data that operate as a scoping-index of the raw data, wherein the security data digest is associated with a two-stage search that includes: (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006, Noel, para [0068]. Generating higher-level summary graph entities from raw data).
However, Noel does not explicitly disclose the limitation:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and
deploying the security data digest associated with generating a security posture of the computing environment.
Ross discloses:
deploying the security data digest associated with generating a security posture of the computing environment (The progressive trigger framework system 122 to include a primary analysis engine 124. The primary analysis engine 124 can be configured to receive structured or unstructured data input (i.e., raw data) from various sources, Ross, para [0045]. The system ingests structured or unstructured raw data and transforms it into higher-level quantities such as detection probability per time period and a trigger indicator of behavior. Those quantities are effectively a security data digest (a summarized, model-based representation of entity behavior) that is deployed in the computing environment to detect malicious entity behavior and provide accurate indicator of behavior which functions as a security posture indicator for entities).
However, Noel in view of Ross does not explicitly disclose the limitations:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and
Alayli discloses:
(i) using a first search over the security data digest to identify summary entities that contain data of interest; and (The search service uses the catalog/ index information to identify a list of partitions considered to contain data responsive to the query. The query peer then uses the manifest dictionary to identify search terms and retrieves corresponding posting lists and those lists are intersected to determine the relevant data blocks, Alayli, claim 1. This is the first stage search. The system does not initially search all underlying raw data. It searches compact catalog information to determine which partitions or data blocks potentially contain the requested information. Thus, the identified partitions or block IDs correspond to the summary entities identifying data of interest)
(ii) using the summary entities identified via the first search and a second search over a scoped sub-portion of the raw data to identify detailed query results; and (After consulting the index, the posting lists are then intersected to obtain final block identifiers in the data file. The system then requests only the corresponding contiguous byte ranges from the data file, processes those selected raw data blocks, produces partial results and consolidates them into the query response, Alayli, para [0029]. Here, the summary entities via the first search corresponds to the selected block identifiers and the scoped sub portion of the raw data is only the data.hdx.blocks or the byte ranges identified by those block IDs and the processing the retrieved selected data blocks to obtain the actual responsive records aligns with the second search to identify detailed query results)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Alayli by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) with two stage search (Alayli). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel and Ross with Alayli in order to effectively reduce the amount of raw data retrieved and processed thereby improving query efficiency and scalability when generating detailed results (See Alayli, para [0029]).
As per claim 17, Noel, Ross and Alayli disclose the method of claim 16, wherein
Furthermore, Noel discloses:
generating the security data digest comprises using a security data digest model to generate the plurality of summary entities, the plurality of summary entities are generated based on a plurality of summary entity types associated with security queries of known security investigations (The system can correlate intrusion alerts to known vulnerability paths and suggest best courses of action for responding to attacks for maintaining mission readiness. The ingested data parsed so as to provide data to build a multitude of nodes and relationships. Queries can be executed against the graph database model to investigate security incidents, Noel, para [0005], [0066] - [0070]).
As per claim 18, Noel, Ross and Alayli discloses the method of claim 16, further comprising:
using the security data digest, generating a security posture visualization associated with the computing environment, wherein the security posture visualization comprises a summary entity of the security data digest; and (Ingested data 1002 can be parsed so as to provide data to build a multitude of nodes 1004 and relationships 1006 that will eventually be converted into nodes and edges of a graph database and system can synthesize information to create an overall visualization of the security posture, Noel, para [0018] and [0068]).
communicating the security posture visualization to cause display of the security posture visualization comprising the summary entity (The graph model 200 can be ready to be queried by a user of the graph model using a domain-specific query language, Noel, para [0036]. This implies that results are communicated to the users/UI).
Furthermore, Ross discloses:
receiving a request for the security posture of the computing environment; (Device 202 may request a particular service, Ross, para [0096]. Accurate indicator of behaviors indicating occurrence of malicious behavior is effectively a security posture indicator for each entity in the computing environment).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
As per claim 19, Noel, Ross and Alayli discloses the method of claim 18, wherein generating the security posture visualization comprises:
generating a first query result for security, wherein the first query result comprises the summary entity; and (The database login (after stealing the password) is essentially indistinguishable from a benign login, and thus has no associated vulnerability or alert, Noel, para [0048]. This is a query result the analyst might suspect that these are potentially multiple attack steps by the same threat actor)
using the first query result, generating the security posture visualization (System 1000 can synthesize information from disparate and varied sources to create an overall visualization of the security posture, Noel, para [0018]).
Furthermore, Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047])
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
Claims 7,9,14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Noel et al. (US 20170289187 A1), hereinafter referred to as Noel in view of Ross et al. (US 20210342441 A1), hereinafter referred to as Ross in further view Alayli et al. (US 20200372071 A1) in further view of Trost et al (US 10902114 B1), hereinafter referred to as Trost.
As per claim 7, Noel, Ross and Alayli discloses the system of claim 1, wherein generating the security posture visualization comprises:
generating a first query result for security; (Queries are inputted into the system and results are outputted, Noel, para [0057]).
Furthermore, Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
However, Noel, Ross and Alayli does not explicitly disclose the limitations:
based on the first query result, determining to execute the security query using the raw data;
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query;
using the sub-portion of the raw data, generating a second query result for the security query; and
using the second query result, generating the security posture visualization
Trost discloses:
based on the first query result, determining to execute the security query using the raw data; (Determine a degree of overlap between the first and second subsets, Trost, col 14, lines 45-46. This is similar to using the first result to decide whether and where to run a deeper data query)
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query; (Executing a query for additional indicators of compromise based on the overlap, Trost, col 14, lines 51-58)
using the sub-portion of the raw data, generating a second query result for the security query; and (Identifying common indicators of compromise in the first and second subset data, Trost, col 14, lines 47-50)
using the second query result, generating the security posture visualization (The investigations platform can be configured to display data in layers, Trost, col 15, lines 25-29).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Trost by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) and two stage search (Alayli) with the detection, aggregation, and integration of cybersecurity threats (Trost). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel, Ross and Alayli with Trost in order to effectively evaluate information based on defined scores to display threats and risks to users (See Trost, col 15, lines 25-29).
As per claim 9, Noel, Ross and Alayli disclose the system of claim 1, wherein
However, Noel, Ross, Alayli does not explicitly disclose the limitations:
the security posture visualization is associated with a first query result generated using the security data digest and a second query result generated using the security data digest and an identified sub-portion of the raw data
Trost discloses:
the security posture visualization is associated with a first query result generated using the security data digest and a second query result generated using the security data digest and an identified sub-portion of the raw data (Exporting a first subset of the formatted threat intelligence information, Trost, col 14, lines 38-40, determining a degree of overlap between the first and second subsets, Trost, col 14, lines 45-46, calculating a graphical side-by-side comparison, Trost, col 14, lines 51-52).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Trost by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) and two stage search (Alayli) with the detection, aggregation, and integration of cybersecurity threats (Trost). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel, Ross and Alayli with Trost in order to effectively evaluate information based on defined scores to display threats and risks to users (See Trost, col 15, lines 25-29).
As per claim 14, Noel, Ross and Alayli discloses the media of claim 11, the operations further comprising:
generating a first query result for security; (Queries are inputted into the system and results are outputted, Noel, para [0057]).
Furthermore, Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
However, Noel, Ross and Alayli does not explicitly disclose the limitations:
based on the first query result, determining to execute the security query using the raw data;
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query;
using the sub-portion of the raw data, generating a second query result for the security query; and
using the second query result, generating the security posture visualization
Trost discloses:
based on the first query result, determining to execute the security query using the raw data; (Determine a degree of overlap between the first and second subsets, Trost, col 14, lines 45-46. This is similar to using the first result to decide whether and where to run a deeper data query).
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query; (Executing a query for additional indicators of compromise based on the overlap, Trost, col 14, lines 51-58)
using the sub-portion of the raw data, generating a second query result for the security query; and (Identifying common indicators of compromise in the first and second subset data, Trost, col 14, lines 47-50)
using the second query result, generating the security posture visualization (The investigations platform can be configured to display data in layers, Trost, col 15, lines 25-29).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Trost by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) and two stage search (Alayli) with the detection, aggregation, and integration of cybersecurity threats (Trost). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel, Ross and Alayli with Trost in order to effectively evaluate information based on defined scores to display threats and risks to users (See Trost, col 15, lines 25-29).
As per claim 20, Noel, Ross and Alayli disclose the method of claim18, wherein generating the security posture visualization comprises:
generating a first query result for security; (Queries are inputted into the system and results are outputted, Noel, para [0057]).
Furthermore, Ross discloses:
accessing a security query associated with the security data digest; (The primary analysis engine 124 can also be configured to send signals (dynamic risk signals) as to dynamic actions, dynamic data protection, dynamic user protection, etc. back to the data source (e.g., sending endpoint), Ross, para [0046])
executing the security query using the security data digest; (Processed data from the primary analysis engine 124 is communicated to a data stores, that can include storage system 106, Ross, para [0047]).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel with Ross by analyzing cyber-attacks and progressive trigger data and detection model (Ross). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel with Ross in order to effectively identify and mitigate risks (See Ross, para [0096]).
However, Noel, Ross and Alayli does not explicitly disclose the limitations:
based on the first query result, determining to execute the security query using the raw data;
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query;
using the sub-portion of the raw data, generating a second query result for the security query; and
using the second query result, generating the security posture visualization
Trost discloses:
based on the first query result, determining to execute the security query using the raw data; (Determine a degree of overlap between the first and second subsets, Trost, col 14, lines 45-46. This is similar to using the first result to decide whether and where to run a deeper data query)
using the security query, the security data digest, and the first query result, identifying a sub-portion of the raw data for executing the security query; (Executing a query for additional indicators of compromise based on the overlap, Trost, col 14, lines 51-58)
using the sub-portion of the raw data, generating a second query result for the security query; and (Identifying common indicators of compromise in the first and second subset data, Trost, col 14, lines 47-50).
using the second query result, generating the security posture visualization (The investigations platform can be configured to display data in layers, Trost, col 15, lines 25-29).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Noel and Ross with Trost by analyzing cyber-attacks (Noel) and progressive trigger data and detection model (Ross) and two stage- search (Alayli) with the detection, aggregation, and integration of cybersecurity threats (Trost). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Noel, Ross and Alayli with Trost in order to effectively evaluate information based on defined scores to display threats and risks to users (See Trost, col 15, lines 25-29).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RAGHAVENDER CHOLLETI whose telephone number is (703) 756-1065. The examiner can normally be reached M-F 9am-5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, RUPAL DHARIA can be reached on (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Respectfully submitted,
/RAGHAVENDER NMN CHOLLETI/Examiner, Art Unit 2492
/RUPAL DHARIA/Supervisory Patent Examiner, Art Unit 2492
Prosecution Insights