FINAL ACTION
Response to Amendment
Claim Rejections - 35 USC § 101
Applicant’s arguments, see remarks, filed 2/02/2026, with respect to USC § 101 have been fully considered and are persuasive. The rejection has been withdrawn.
Claim Rejections - 35 USC § 102
Applicant's arguments filed 2/02/2026 have been fully considered but they are not persuasive.
Torbett describes the use of a data table as an intermediate step in real time processing: “As discussed below, the intake system 210 may be configured to conduct such processing rapidly (e.g., in “real-time” with little or no perceptible delay), while ensuring resiliency of the data.” (column 20 lines 1-3), “Columns contain basic information about the data and also may contain data that has been dynamically extracted at search time.” (column 108 lines 31-36), “At block 2242, the set of events generated in the first part of the query may be piped to a query that searches the set of events for field-value pairs or for keywords. For example, the second intermediate results table 2226 shows fewer columns, representing the result of the top command, “top user” which summarizes the events into a list of the top 10 users and displays the user, count, and percentage.” (column 108 lines 58-65). Whether the analysis is performed in response to a query doesn’t change the method of analysis itself which is what the claim language describes. Torbett does describe monitoring processes being initiated in response to a trigger (column 12 lines 20-35), as well as generating alerts in response to events based on monitoring (column 132 lines 65-68).
The thresholds of metrics taught by Torbett are mapped to human readable values, but the KPI metrics are also used in real time adaptive thresholding with (column 180 lines 53-60), which describes real time history based analysis. The adaptive thresholding can also be used to analyze KPI values falling within time windows (column 181 lines 20-25).
A staging table as claimed only needs to be able to store data. The processing, updating or removal of data being also taught is interpreted as comparable without a claimed functional limitation. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Claim Objections
Claims 4, 10, 11 are objected to because of the following informalities: the claims recite …each microservice processor ingest event activity data specifically from… which will be interpreted as “…processor configured to ingest…”. Appropriate correction is required.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-4, 8-15, 19 and 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Torbett (US 11687438).
Regarding claim 1, Torbett teaches A system for identifying anomalies in event activity data, the system comprising: a plurality of data sources comprising at least a first data source and a second data source; (“Each data source 202 broadly represents a distinct source of data that can be consumed by the data intake and query system 108. Examples of data sources 202 include, without limitation, data files, directories of files, data sent over a network, event logs, registries, streaming data services” col 14 lines 24-28); a first microservice processor configured to ingest a first activity data specifically from the first data source (“Thus, individual devices implementing the streaming data processors 308 may subscribe to different topics on the intake ingestion buffer 306, and the number of devices subscribed to an individual topic may vary according to a rate of publication of messages to that topic” column 26 lines 32-27) and configured to process the first data source to form a first plurality of metrics that are condensed metrics representing the first event activity data, for a time segment; (“To reduce the potentially vast amount of data that may be generated, some data systems pre-process data based on anticipated data analysis needs” column 1 lines 42-45); to reduce processing load (“For example, pre-specified data items may be extracted from the machine data and stored in a database to facilitate efficient retrieval and analysis of those data items at search time. However, the rest of the machine data typically is not saved and is discarded during pre-processing” column 7 lines 15-20); a second microservice processor and configured to ingest a second event activity data specifically from process the second data source to form a second plurality of metrics that are condensed metrics representing the second event activity data for the time segment; (“Separately, one or more of the streaming data processors 308 can obtain pipeline metrics describing the operation of the data ingestion pipeline” col 135 lines 61-63, “Different pipeline metrics corresponding to the same time instant or time period can be ingested.” Col 136 lines 16-18). “Separately one or more” is interpreted as including a first and second data processor obtaining metrics from a first and second pipleine; to reduce processing load (“For example, pre-specified data items may be extracted from the machine data and stored in a database to facilitate efficient retrieval and analysis of those data items at search time. However, the rest of the machine data typically is not saved and is discarded during pre-processing” column 7 lines 15-20) a monitoring processor configured to: obtain the first plurality of metrics for the time segment from the first microservice processor; obtain the second plurality of metrics for the time segment from the second microservice processor; (“the streaming data processor(s) 308 can spin up or launch multiple pipeline metric outlier detectors 3408 that collectively perform a multi-variate time-series outlier detection,” col 148 lines 29-34, “The pipeline metric outlier detector(s) 3408 can receive one or more pipeline metrics that correspond to various time instants.” Col 148 lines 37-39); update a staging table with aggregate data (“In certain embodiments, the search manager 514 or search nodes 506 can store query results in the query acceleration data store 222. In some embodiments, the query results can correspond to partial results from one or more search nodes 506 or to aggregated results from all the search nodes 506 involved in a query or the search manager 514.” Column 54 lines 27-32) comprised of the first and second plurality of metrics; (“In some embodiments, the system maintains a separate summarization table for each of the above-described time-specific buckets that stores events for a specific time range.” Col 120 lines 44-46);and limit or eliminate personally-identifiable data it contains (““Removal of information may be beneficial, for example, where the messages include private, personal, or confidential information which is unneeded or should not be made available by a downstream system” column 59 lines 1-4) determine in real time (“As discussed below, the intake system 210 may be configured to conduct such processing rapidly (e.g., in “real-time” with little or no perceptible delay), while ensuring resiliency of the data.” Column 20 lines 1-4) a first threshold baseline for the first plurality of metrics based on one or more past instances of the time segment; determine in real time a second threshold baseline for the second plurality of metrics by analyzing the one or more past instances of the time segment stored in the staging table; (“ Thresholds associated with a particular KPI definition determine ranges of values for that KPI that correspond to the various state values. In one case, KPI values 95-100 may be set to correspond to ‘critical’” col 132 lines 24-28, ); display a first indication of the first plurality of metrics in a dashboard to identify anomalous activity, wherein the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline; and display a second indication of the second plurality of metrics in the dashboard (“If the combined score exceeds a threshold, this may indicate that the ingested pipeline metric(s) are truly anomalous and not false positives. Thus, the streaming data processor(s) 308 or another component of the data intake and query system 108 can then generate a user interface or alert that indicates that the ingested pipeline metric(s) are anomalous” col 136 lines 40-45).
Regarding claim 2, Torbett teaches the system of claim 1 as shown above, and wherein the second indication is displayed proximally with the first indication.(“ a graph showing a distribution of events corresponding to the data pattern corresponding to the respective row, with an indication of a portion of the graph considered anomalous, if applicable (e.g., the shaded portion of the graph may be considered anomalous); a type of anomalous event or data pattern corresponding to the respective row;” col 162 lines 58-64, Fig 52A). Data listed in rows is interpreted as within the broadest reasonable interpretation of “proximally located”.
Regarding claim 3, Torbett teaches the system of claim 2 as shown above and , wherein the first and second indication comprise a connection indicator between the first and second indication. (“Other types of graphs may be shown in the row without limitation. In some implementations, the row may indicate a series of graphs that are associated with the data pattern corresponding to the respective row, where each graph corresponds to one of the token values of the data pattern. In particular, any given data pattern might have multiple (same or different) visualizations because of the types of token values corresponding to the data pattern.” Col 164 lines 27-34). Connection indicator is interpreted as anything displaying information that corresponds to different pieces of data.
Regarding claim 4, Torbett teaches at least one additional microservice processor, each microservice processor ingest activity data specifically from a respective source configured to process the respective data source to form a respective plurality of metrics (“Separately, one or more of the streaming data processors 308 can obtain pipeline metrics describing the operation of the data ingestion pipeline, which can include the forwarder 302, the data retrieval subsystem 304, the intake ingestion buffer 306, other streaming data processor(s) 308 (e.g., streaming data processor(s) 308 other than the streaming data processor(s)” col 135 lines 61-66). that are condensed metrics representing the event activity data for the time segment (“To decrease search times and reduce overhead and storage associated with the buckets (while maintaining a reduced delay between processing the data and making it searchable), the bucket manager 414 can monitor the buckets stored in the data store 412 and/or common storage 216 and merge buckets according to a bucket merge policy.” Column 35 lines 18-23); One or more processors can include any number, nothing clearly distinguishes the one additional processor from others; wherein the monitoring processor is further configured to, for each respective one of the at least one additional microservice processor: obtain the respective plurality of metrics for the time segment (“the streaming data processor(s) 308 can spin up or launch multiple pipeline metric outlier detectors 3408 that collectively perform a multi-variate time-series outlier detection,” col 148 lines 29-34, “The pipeline metric outlier detector(s) 3408 can receive one or more pipeline metrics that correspond to various time instants.” Col 148 lines 37-39); update a staging table with the respective plurality of metrics; (“In some embodiments, the system maintains a separate summarization table for each of the above-described time-specific buckets that stores events for a specific time range.” Col 120 lines 44-46); compute a respective threshold baseline for the respective plurality of metrics based on one or more past instances of the time segment; (“ Thresholds associated with a particular KPI definition determine ranges of values for that KPI that correspond to the various state values. In one case, KPI values 95-100 may be set to correspond to ‘critical’” col 132 lines 24-28) and display a respective indication of the respective plurality of metrics in a dashboard (“If the combined score exceeds a threshold, this may indicate that the ingested pipeline metric(s) are truly anomalous and not false positives. Thus, the streaming data processor(s) 308 or another component of the data intake and query system 108 can then generate a user interface or alert that indicates that the ingested pipeline metric(s) are anomalous” col 136 lines 40-45).
Regarding claim 8, Torbett teaches wherein the first microservice processor processes the first data source in a pipelined process for the time segment by querying the first data source for data associated with the time segment.(“ The streaming data processor(s) 308 can then identify anomalous logs (e.g., based on converting the logs into a comparable data structure, assigning the comparable data structure to a data pattern, and analyzing the comparable data structures assigned to the data pattern, as described above) corresponding to the same time instant or time period as the ingested pipeline metric(s)” col 136 lines 22-27, “Different pipeline metrics corresponding to the same time instant or time period can be ingested.” Col 136 lines 16-18).
Regarding claim 9, Torbett teaches A method for identifying anomalies in event activity data from a plurality of data sources having at least a first data source and a second data source, (“Each data source 202 broadly represents a distinct source of data that can be consumed by the data intake and query system 108. Examples of data sources 202 include, without limitation, data files, directories of files, data sent over a network, event logs, registries, streaming data services” col 14 lines 24-28) the method comprising a monitoring processor: obtaining a first plurality of metrics for a time segment; obtaining a second plurality of metrics for the time segment; (“the streaming data processor(s) 308 can spin up or launch multiple pipeline metric outlier detectors 3408 that collectively perform a multi-variate time-series outlier detection,” col 148 lines 29-34, “The pipeline metric outlier detector(s) 3408 can receive one or more pipeline metrics that correspond to various time instants.” Col 148 lines 37-39); updating a staging table with aggregate data comprised of the first and second plurality of metrics;( “In some embodiments, the system maintains a separate summarization table for each of the above-described time-specific buckets that stores events for a specific time range.” Col 120 lines 44-46); and limit or eliminate personally-identifiable data (““Removal of information may be beneficial, for example, where the messages include private, personal, or confidential information which is unneeded or should not be made available by a downstream system” column 59 lines 1-4) determining in real time a first threshold baseline for the first plurality of metrics by analyzing one or more past instances of the time segment; determining in real time a second threshold baseline for the second plurality of metrics based on the one or more past instances of the time segment stored in the staging table; (“ Thresholds associated with a particular KPI definition determine ranges of values for that KPI that correspond to the various state values. In one case, KPI values 95-100 may be set to correspond to ‘critical’” col 132 lines 24-28) displaying a first indication of the first plurality of metrics in a dashboard, wherein the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline; and displaying a second indication of the second plurality of metrics in the dashboard. (“For example, the anomaly detector 3406 or another component in the data intake and query system 108 can generate user interface data based on the anomalies detected by the anomaly detector 3406 such that the user interface data, when rendered by a client device 204, causes the client device 204 to display one or more user interfaces depicting the anomaly information.” Col 148 lines 7-14).
Regarding claim 10, Torbett teaches the method of claim 9 as shown above, and wherein the first plurality of metrics is obtained from a first microservice processor ingest a first event activity data specifically from the first data source and configured to process the first data source to form the first plurality of metrics (“Separately, one or more of the streaming data processors 308 can obtain pipeline metrics describing the operation of the data ingestion pipeline” col 135 lines 61-63, “Different pipeline metrics corresponding to the same time instant or time period can be ingested.” Col 136 lines 16-18); that are condensed metrics representing the first event activity data for the time segment to reduce processing load (“To decrease search times and reduce overhead and storage associated with the buckets (while maintaining a reduced delay between processing the data and making it searchable), the bucket manager 414 can monitor the buckets stored in the data store 412 and/or common storage 216 and merge buckets according to a bucket merge policy.” Column 35 lines 18-23).
Regarding claim 11, Torbett teaches the method of claim 10 as shown above, and wherein the second plurality of metrics is obtained from a second microservice processor ingest a second event activity data specifically from the second data source configured to process the second data source to form the second plurality of metrics for the time segment (“Separately, one or more of the streaming data processors 308 can obtain pipeline metrics describing the operation of the data ingestion pipeline” col 135 lines 61-63, “Different pipeline metrics corresponding to the same time instant or time period can be ingested.” Col 136 lines 16-18); to reduce processing load (“To decrease search times and reduce overhead and storage associated with the buckets (while maintaining a reduced delay between processing the data and making it searchable), the bucket manager 414 can monitor the buckets stored in the data store 412 and/or common storage 216 and merge buckets according to a bucket merge policy.” Column 35 lines 18-23).
Regarding claim 12, Torbett teaches wherein the second indication is indicative that second first plurality of metrics exceeds the second threshold baseline, and wherein the second indication is displayed proximally with the first indication. .(“ a graph showing a distribution of events corresponding to the data pattern corresponding to the respective row, with an indication of a portion of the graph considered anomalous, if applicable (e.g., the shaded portion of the graph may be considered anomalous); a type of anomalous event or data pattern corresponding to the respective row;” col 162 lines 58-64, Fig 52A).
Regarding claim 13, Torbett teaches wherein the first and second indication comprise a connection indicator between the first and second indication. (“Other types of graphs may be shown in the row without limitation. In some implementations, the row may indicate a series of graphs that are associated with the data pattern corresponding to the respective row, where each graph corresponds to one of the token values of the data pattern. In particular, any given data pattern might have multiple (same or different) visualizations because of the types of token values corresponding to the data pattern.” Col 164 lines 27-34)
Regarding claim 14, Torbett teaches further comprising: at least one additional microservice processor processing ingesting event activity data specifically from a respective data source. And processing the respective data source to form a respective plurality of metrics for the time segment. (“Separately, one or more of the streaming data processors 308 can obtain pipeline metrics describing the operation of the data ingestion pipeline” col 135 lines 61-63”)
Regarding claim 15, Torbett teaches the method of claim 14 as shown above, and further comprising the monitoring processor, for each respective one of the at least one additional microservice processor: obtaining the respective plurality of metrics for the time segment; (“the streaming data processor(s) 308 can spin up or launch multiple pipeline metric outlier detectors 3408 that collectively perform a multi-variate time-series outlier detection,” col 148 lines 29-34, “The pipeline metric outlier detector(s) 3408 can receive one or more pipeline metrics that correspond to various time instants.” Col 148 lines 37-39); updating the staging table with the respective plurality of metrics; (“In some embodiments, the system maintains a separate summarization table for each of the above-described time-specific buckets that stores events for a specific time range.” Col 120 lines 44-46); determining in real time a respective threshold baseline for the respective plurality of metrics by analyzing the one or more past instances of the time segment; (“ Thresholds associated with a particular KPI definition determine ranges of values for that KPI that correspond to the various state values. In one case, KPI values 95-100 may be set to correspond to ‘critical’” col 132 lines 24-28) and displaying a respective indication of the respective plurality of metrics in the dashboard. (“If the combined score exceeds a threshold, this may indicate that the ingested pipeline metric(s) are truly anomalous and not false positives. Thus, the streaming data processor(s) 308 or another component of the data intake and query system 108 can then generate a user interface or alert that indicates that the ingested pipeline metric(s) are anomalous” col 136 lines 40-45).
Regarding claim 19, Torbett teaches wherein the first microservice processor processes the first data source in a pipelined process for the time segment by querying the first data source for data associated with the time segment.(“ The streaming data processor(s) 308 can then identify anomalous logs (e.g., based on converting the logs into a comparable data structure, assigning the comparable data structure to a data pattern, and analyzing the comparable data structures assigned to the data pattern, as described above) corresponding to the same time instant or time period as the ingested pipeline metric(s)” col 136 lines 22-27, “Different pipeline metrics corresponding to the same time instant or time period can be ingested.” Col 136 lines 16-18).
Regarding claim 20, Torbett teaches A non-transitory computer readable medium storing computer executable instructions which, when executed by at least one computer processor, cause the at least one computer processor to carry out a method (“Computer programs typically comprise one or more instructions set at various times in various memory devices of a computing device, which, when read and executed by at least one processor, will cause a computing device to execute functions involving the disclosed techniques. In some embodiments, a carrier containing the aforementioned computer program product is provided. The carrier is one of an electronic signal, an optical signal, a radio signal, or a non-transitory computer-readable storage medium. Columns 196-197, lines 66, 67 and 1-7). The method is substantially the same as the method of claim 9 which is also taught as shown above.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 5-7 and 16-18 are rejected under 35 U.S.C. 103 as being unpatentable over Torbett in view of Chen (US 20240020116).
Regarding claim 5, Torbett teaches further comprising an agent processor, the agent processor configured to: monitor the dashboard for the first indication; when the first indication is indicative that the first plurality of metrics exceeds the first threshold baseline, (“If the combined score exceeds a threshold, this may indicate that the ingested pipeline metric(s) are truly anomalous and not false positives. Thus, the streaming data processor(s) 308 or another component of the data intake and query system 108 can then generate a user interface or alert that indicates that the ingested pipeline metric(s) are anomalous” col 136 lines 40-45). Torbett does not teach generate a natural language summary of the first indication; and transmit the natural language summary of the first indication to a message service.
Chen teaches generate a natural language summary of the first indication; and transmit the natural language summary of the first indication to a message service (“…and automated error messages (e.g., generating natural language error messages…” ¶114). It would have been obvious for one of ordinary skill in the art prior to the filing of the claimed invention to combine the monitoring and anomaly detection system taught by Torbett with the use of natural language for automated error messages as taught by Chen. Doing so could make the indications easier to understand (¶114).
Regarding claim 6, Torbett and Chen teach the system of claim 5 as shown above. Torbett teaches wherein the agent processor is further configured to monitor the message service for a command instruction and, in response to receipt of the command instruction, interact with the dashboard. (“ For example, the second intermediate results table 2226 shows fewer columns, representing the result of the top command, “top user” which summarizes the events into a list of the top 10 users and displays the user, count, and percentage.” Col 108 lines 60-64).
Regarding claim 7, Torbett and Chen teach the system of claim 6 as shown above. Torbett teaches wherein the interacting with the dashboard interface comprises retrieving additional detail from the dashboard interface regarding the first indication. (“ representing the result of the top command, “top user” which summarizes the events into a list of the top 10 users and displays the user, count, and percentage.” Col 108 lines 62-24).
Regarding claim 16, Torbett teaches the method of claim 9 as shown above. The rest of the claim is substantially the same as claim 5 and is rejected for the same reasons.
Regarding claims 17 and 18, they recite identical additional limitations to claims 6 and 7 respectively and are rejected for the same reasons.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
/SEAN KEVIN MCNAMARA/Examiner, Art Unit 2113
/PHILIP GUYTON/Primary Examiner, Art Unit 2113
Prosecution Insights