Prosecution Insights
Last updated: April 19, 2026
Application No. 18/517,747

USING GRAPH-BASED QUERIES TO MONITOR AN ENVIRONMENT

Non-Final OA §103
Filed
Nov 22, 2023
Examiner
SHAW, PETER C
Art Unit
2493
Tech Center
2400 — Computer Networks
Assignee
Lacework Inc.
OA Round
3 (Non-Final)
76%
Grant Probability
Favorable
3-4
OA Rounds
3y 5m
To Grant
99%
With Interview

Examiner Intelligence

Grants 76% — above average
76%
Career Allow Rate
422 granted / 553 resolved
+18.3% vs TC avg
Strong +36% interview lift
Without
With
+35.7%
Interview Lift
resolved cases with interview
Typical timeline
3y 5m
Avg Prosecution
46 currently pending
Career history
599
Total Applications
across all art units

Statute-Specific Performance

§101
11.2%
-28.8% vs TC avg
§103
55.7%
+15.7% vs TC avg
§102
13.9%
-26.1% vs TC avg
§112
12.7%
-27.3% vs TC avg
Black line = Tech Center average estimate • Based on career data from 553 resolved cases

Office Action

§103
DETAILED ACTION Claims 1, 3-9, 11-16 and 18-20 are pending in this action. Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or nonobviousness. Claims 1, 13, 14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Abrams et al. (US PGPUB No. 2013/0339385) [hereinafter “Abrams”] in view of Kraus et al. (US PGPUB No. 2017/0154108) [hereinafter “Kraus”] in further view of Fuller et al. (US PGPUB No. 2012/0290559) [hereinafter “Fuller”]. As per claim 1, Abrams teaches a method, comprising: receiving, at a data platform, information associated with activities within a network environment ([0016], network data stored at data sources across a federated system); generating a logical graph based on the information (Abstract, data source may a be graph database); storing data representative of the logical graph in a database ([0024], data stored at data source that includes graph databases); receiving, in response to a user interaction with an interface of the data platform, a request to filter the information ([0024], receiving a query to a data source on a federated system); in response to receiving the request, generating a query using a graph-based schema ([0024], generating an appropriate subquery for the data source including graph databases see Abstract); and performing the generated query against the database ([0024], returning the subquery results to the client system). Abrams does not explicitly teach generating a logical graph based on the information, wherein the logical graph links login activity to at least one user and at least one process. Kraus teaches generating a logical graph based on the information, wherein the logical graph links login activity to at least one user and at least one process ([0058], a database schema with a graph representing a database structure populated with data linking and mapping network events to user login history and other relevant activity see [0070]). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams with the teachings of Kraus, generating a logical graph based on the information, wherein the logical graph links login activity to at least one user and at least one process, to populate the graph and database with various data as intended to take advantage of organizational and search functionality present in the logical graph and database. The combination of Abrams and Kraus does not explicitly teach wherein generating the query comprises constructing a join graph that represents relationships of filter keys among entities; and traversing the edges of the join graph to create a final data filter set wherein the join graph includes a list of relationships among all possible implicit join groups. Fuller teaches wherein generating the query comprises constructing a join graph that represents relationships of filter keys among entities ([0055], generating a join graph that contains relationships between entity data see [0002] including classifications of the data, i.e. keys see [0003]); and traversing the edges of the join graph to create a final data filter set wherein the join graph includes a list of relationships among all possible implicit join groups ([0053], join graph lists all joined tables as implicit joins between groups of entity data see [0002]). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams and Kraus with the teachings of Fuller, wherein generating the query comprises constructing a join graph that represents relationships of filter keys among entities; and traversing the edges of the join graph to create a final data filter set wherein the join graph includes a list of relationships among all possible implicit join groups, to link entities in manner that improves query efficiency. As per claim 13, the combination of Abrams, Kraus and Fuller teaches the method of claim 1, wherein the user interaction is with a query field of the interface (Abrams; Abstract, user interacts with database using his computer by querying the database which inherently has input fields). As per claim 14, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale. As per claim 20, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale. Claims 3-9, 11-12 and 16, 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Abrams, Kraus and Fuller in view of Trappen et al. (US PGPUB No. 2004/0019599) [hereinafter “Trappen”]. As per claim 3, the combination of Abrams, Kraus and Fuller teaches the method of claim 1. The combination of Abrams, Kraus and Fuller does not explicitly teach wherein generating the query is based on a join defining a group of filter keys of a same key type. Trappen teaches wherein generating the query is based on a join defining a group of filter keys of a same key type ([0147], entities with a labeled class and joined with the same class type). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams and Kraus with the teachings of Trappen, wherein generating the query is based on a join defining a group of filter keys of a same key type, to link entities in manner that improves query efficiency. As per claim 4, the combination of Abrams, Kraus, Fuller and Trappen teaches the method of claim 3, wherein instances of the same type of filter key are formed as an implicit join group (Trappen; [0147], join is made as an implicit join since it read from the class table mapping). As per claim 5, the combination of Abrams, Kraus, Fuller and Trappen teaches the method of claim 3, wherein a same instance of a filter key can participate in different implicit join groups (Trappen; [0143], a filter key can be combined and used in more than one join). As per claim 6, the combination of Abrams, Kraus and Fuller teaches the method of claim 1 The combination of Abrams, Kraus and Fuller does not explicitly teach wherein generating the query comprises discovering join relations via a filter key specification. Trappen teaches wherein generating the query comprises discovering join relations via a filter key specification (Trappen; class table mapping). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein generating the query comprises discovering join relations via a filter key specification, to link entities in manner that improves query efficiency. As per claim 7, the combination of Abrams, Kraus and Fuller teaches the method of claim 1 The combination of Abrams, Kraus and Fuller does not explicitly teach wherein generating the query is based on a join performed across at least one of event queries, network queries, or configuration queries. Trappen wherein generating the query is based on a join performed across at least one of event queries ([0061], context of join function involves tasks performed on abstract data types see also Abstract), network queries (Examiner Note: this is an optional feature but to expedite prosecution a potential citation is provided) ([0061], tasks are performed across network see also Abstract), or configuration queries (Examiner Note: this is an optional feature but could overcome the current rejection if included as a required feature along with the other options). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein generating the query is based on a join performed across at least one of event queries, network queries, or configuration queries, to link entities in manner that improves query efficiency. As per claim 8, the combination of Abrams, Kraus and Fuller teaches the method of claim 1 The combination of Abrams, Kraus and Fuller does not explicitly teach wherein the join graph comprises a list of join links. Trappen teaches wherein the join graph comprises a list of join links ([0147], class table mapping). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein the join graph comprises a list of join links, to link entities in manner that improves query efficiency. As per claim 9, the combination of Abrams, Kraus and Trappen teaches the method of claim 8, wherein a join link represents an implicit join group by a same filter key type (Trappen; [0149], classes in mapping represent groups with same filter key and represent an implicit join). As per claim 11, the combination of Abrams, Kraus and Fuller teaches the method of claim 1 The combination of Abrams, Kraus and Fuller does not explicitly teach wherein the request is associated with target information useable to generate or update a visualization of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment. Trappen teaches wherein the request is associated with target information useable to generate or update a visualization of at least a portion of the logical graph in the interface ([0067], user uses display to interface with system), the logical graph comprising a plurality of nodes interconnected by a plurality of edges ([0126], constructing a DAG with nodes and edges), the plurality of nodes and the plurality of edges representative of the activities within the network environment ([0126], edges represents relationship between nodes operating network transactions see [0274]). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein the request is associated with target information useable to generate or update a visualization of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment, to link entities in manner that improves query efficiency. As per claim 12, the combination of Abrams, Kraus and Fuller teaches the method of claim 1 The combination of Abrams, Kraus and Fuller does not explicitly teach wherein the user interaction is with a representation of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment. Trappen teaches wherein the user interaction is with a representation of at least a portion of the logical graph in the interface ([0067], user uses display to interface with system), the logical graph comprising a plurality of nodes interconnected by a plurality of edges ([0126], constructing a DAG with nodes and edges), the plurality of nodes and the plurality of edges representative of the activities within the network environment ([0126], edges represents relationship between nodes operating network transactions see [0274]). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein the user interaction is with a representation of at least a portion of the logical graph in the interface, the logical graph comprising a plurality of nodes interconnected by a plurality of edges, the plurality of nodes and the plurality of edges representative of the activities within the network environment, to link entities in manner that improves query efficiency. As per claim 16, the combination of Abrams, Kraus and Fuller teaches the computer program product of claim 14. The combination of Abrams, Kraus and Fuller does not explicitly teach wherein the join graph comprises a list of join links, each join link representative of an implicit join group by a same filter key type. Trappen teaches wherein the join graph comprises a list of join links, each join link representative of an implicit join group by a same filter key type ([0149], classes in mapping represent groups with same filter key and represent an implicit join). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Trappen, wherein the join graph comprises a list of join links, each join link representative of an implicit join group by a same filter key type, to link entities in manner that improves query efficiency. As per claim 18, the substance of the claimed invention is identical or substantially similar to that of claim 6. Accordingly, this claim is rejected under the same rationale. As per claim 19, the substance of the claimed invention is identical or substantially similar to that of claim 12. Accordingly, this claim is rejected under the same rationale. Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Abrams, Kraus and Fuller in view of Ramsey et al. (US PGPUB No. 2009/0119640) [hereinafter “Ramsey”]. As per claim 15, the combination of Abrams, Kraus and Fuller teaches the computer program product of claim 14. The combination of Abrams, Kraus and Fuller does not explicitly teach wherein generating the query comprises generating an SQL query string using a query building library. Ramsey teaches wherein generating the query comprises generating an SQL query string using a query building library ([0023], SQL query using a library directed to graph). At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Abrams, Kraus and Fuller with the teachings of Ramsey, wherein generating the query comprises generating an SQL query string using a query building library, to link entities in manner that improves query efficiency. Response to Arguments Applicant’s arguments with respect to the rejection of claims 1-20 under 35 U.S.C. 103 have been fully considered by the Examiner. In light of the new amendments, a new prior art reference, Fuller, has been introduced and cited to. To expedite prosecution, Examiner is open to conducting an interview to discuss claim amendments to overcome the current rejection and/or place the application in condition for allowance. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Leida et al. (US PGPUB No. 2013/0262443), Li et al. (US PGPUB No. 2015/0302058), You et al. (US PGPUB No. 2017/0243277), Pang et al. ("A Unified Narrative for Query Processing in Graph Databases," 2025 IEEE 41st International Conference on Data Engineering (ICDE), Hong Kong, Hong Kong, 2025, pp. 4492-4496, doi: 10.1109/ICDE65448.2025.00338) and Li et al. ("Variable-Length Path Query Evaluation Based on Worst-Case Optimal Joins," 2024 IEEE 40th International Conference on Data Engineering (ICDE), Utrecht, Netherlands, 2024, pp. 3311-3323, doi: 10.1109/ICDE60146.2024.00256) all disclose various aspects of the claimed invention including translating relational databases into graph representations and vice versus. Any inquiry concerning this communication or earlier communications from the examiner should be directed to PETER C SHAW whose telephone number is (571)270-7179. The examiner can normally be reached Max Flex. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached on 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /PETER C SHAW/Primary Examiner, Art Unit 2493 January 1, 2026
Read full office action

Prosecution Timeline

Nov 22, 2023
Application Filed
Mar 12, 2025
Non-Final Rejection — §103
Jun 17, 2025
Response Filed
Aug 15, 2025
Final Rejection — §103
Nov 19, 2025
Request for Continued Examination
Nov 30, 2025
Response after Non-Final Action
Jan 03, 2026
Non-Final Rejection — §103
Apr 09, 2026
Examiner Interview Summary
Apr 09, 2026
Applicant Interview (Telephonic)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12566852
NEFARIOUS CODE DETECTION USING SEMANTIC UNDERSTANDING
2y 5m to grant Granted Mar 03, 2026
Patent 12547696
WIRELESS BATTERY MANAGEMENT SYSTEM SAFETY CHANNEL COMMUNICATION LAYER PROTOCOL
2y 5m to grant Granted Feb 10, 2026
Patent 12536342
SOC ARCHITECTURE WITH SECURE, SELECTIVE PERIPHERAL ENABLING/DISABLING
2y 5m to grant Granted Jan 27, 2026
Patent 12511438
DYNAMIC PROVISION OF SOFTWARE APPLICATION FEATURES
2y 5m to grant Granted Dec 30, 2025
Patent 12513190
SNAPSHOT FOR ACTIVITY DETECTION AND THREAT ANALYSIS
2y 5m to grant Granted Dec 30, 2025
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

3-4
Expected OA Rounds
76%
Grant Probability
99%
With Interview (+35.7%)
3y 5m
Median Time to Grant
High
PTA Risk
Based on 553 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month