Prosecution Insights
Last updated: April 19, 2026
Application No. 18/593,741

Double Subscription Service & Reactive Event Notification Loop

Final Rejection §103
Filed
Mar 01, 2024
Examiner
LIU, ZHE
Art Unit
2493
Tech Center
2400 — Computer Networks
Assignee
Crowdstrike Inc.
OA Round
2 (Final)
71%
Grant Probability
Favorable
3-4
OA Rounds
3y 2m
To Grant
99%
With Interview

Examiner Intelligence

Grants 71% — above average
71%
Career Allow Rate
96 granted / 136 resolved
+12.6% vs TC avg
Strong +59% interview lift
Without
With
+59.0%
Interview Lift
resolved cases with interview
Typical timeline
3y 2m
Avg Prosecution
23 currently pending
Career history
159
Total Applications
across all art units

Statute-Specific Performance

§101
5.3%
-34.7% vs TC avg
§103
59.6%
+19.6% vs TC avg
§102
5.0%
-35.0% vs TC avg
§112
23.5%
-16.5% vs TC avg
Black line = Tech Center average estimate • Based on career data from 136 resolved cases

Office Action

§103
DETAILED ACTION The following claims are pending in this office action: 1-20 Claims 1, 8 and 15 are independent claims. The following claims are amended: 1-6, 8 and 15-16 The following claims are new: - The following claims are cancelled: - Claims 1-20 are rejected. This rejection is FINAL. Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . RESPONSE TO ARGUMENTS Applicant’s arguments in the amendment filed 12/06/2025 have been fully considered but are moot in view of new grounds of rejection. Applicant notes: “Pending claims ... have been amended to recite, or incorporate, features not taught or suggested by” the cited prior art. The limitations associated with the “double subscription service” of claim 1 is disclosed by Rajewski (US Pub. 2018/0160153) as explained below and rejected accordingly. Independent claims 8 and 15 are amended in a similar way to claim 1. The amended limitations are disclosed by Rajewski (US Pub. 2018/0160153) as explained below and rejected accordingly. Dependent claims 2-7, 9-14 and 16-20 depend on independent claims 1, 8 and 15. The amended elements in the claims are disclosed by Rajewski (US Pub. 2018/0160153) as explained below, and so any additional features to the dependent claims are rejected accordingly. Examiner notes a subscription service that “subscribes to all graphical nodes associated with a graph” and an intermediary subscription service that “subscribes to a subgroup of the graphical nodes associated with the graph” was taught by Armstrong as indicated below. As such, the limitations associated with “double subscription service” is broadly interpreted to any subscription service that involves two or more subscriptions in view of the claims. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1-9 and 11-13 are rejected under 35 U.S.C. 103 as being unpatentable over Armstrong et al. (US Pub. 2009/0160658) (hereinafter “Armstrong”) in view of Carbune et al. (US Pub. 2021/0279599) (hereinafter “Carbune”) and in view of Rajewski (US Pub. 2018/0160153) (hereinafter “Rajewski”). As per claim 1, Armstrong teaches a method executed by a computer system that publishes an event notification, comprising: ([Armstrong, para. 0009] “FIG. 1 illustrates an overview of a system [computer system] for implementing ... embodiments of the disclosed subject matter”; [para. 0021] “The semantic server [part of the computer system] can alert clients [publishes an event notification] when new information comes in that match their subscriptions”) providing, by the computer system, a subscription service that subscribes to all graphical nodes associated with a graph; ([Armstrong, para. 0020] “Clients [part of the computer system] can create semantic server pages for concept instances represented in the semantic server as a semantic data model or ontology including, for example, individuals ... that are of interest to them”; [para. 0025] “an example of a semantic graph can ... where the nodes [graphical nodes] can be persons”; [para. 0046] “For example, a client [providing, by the computer system] can create a subscription [a subscription service] for all Persons [that subscribes to all graphical nodes nodes]”) providing, by the computer system, an intermediary subscription service that subscribes to a subgroup of the graphical nodes associated with the graph; and ([Armstrong, para. 0026] “clients [by the computer system] ... can subscribe to the portions [subgroup] of the semantic graph [of the graphical nodes associated with the graph] that are currently of interest to their clients”; [para. 0046] “For example, a client can create a subscription [an intermediary subscription service] for ... all Persons who are Members Of any organization [that subscribes to a subgroup]”) publishing, by the computer system, the event notification using the intermediary subscription service. ([Armstrong, para. 0050] “Subscriptions [using the intermediary subscription service as one of the subscription services is a subgroup/intermediary as described above] can allow clients [by the computer system] to be notified [publishing] of information changes of interest on the semantic graph”) Armstrong does not clearly teach providing a double subscription service; an intermediary subscription service nested within the double subscription service. However, Carbune teaches providing, by the computer system, an intermediary subscription service nested within the subscription service. ([Carbune, para. 0007] “an individual that issues a query about the developing event ... may effectively cause that individual to be “subscribed” to receiving updates from the event-specific provisional knowledge graph [an intermediary subscription service] ... In other cases, individuals may be subscribed to receive updates on developing events automatically ... based on those individuals' interests aligning with event “types” of the developing events”; [para. 0059] “knowledge graph 138 [the subscription service], may be leveraged to quickly disseminate new information about the developing event to interested users”; [para. 0045] "event-specific provisional knowledge graph 139 may be implemented ... by provisional knowledge graph manager 136, [by the computer system – see para. 0037 and Fig. 1: “Knowledge system 130 may include one or more computing devices”] as a layer on top of [nested within] general-purpose knowledge graph 138”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Carbune to include providing, by the computer system, an intermediary subscription service nested within the subscription service. One of ordinary skill in the art would have been motivated to make this modification because the event-specific provisional knowledge graph in combination with the general-purpose knowledge graph allows the computer device to automatically present event-specific information associated with the entity in an appropriate format. (Carbune, para. 0003) Armstrong in view of Carbune does not clearly teach providing a double subscription service; and an/the intermediary subscription service nested within the double subscription service. However, Rajewski teaches providing a double subscription service; and ([Rajewski, para. 0014] “The admin app can service multiple ... subscription services [providing a double subscription service] by using the content provider’s login credentials to connect to the correct audience/consumer app”; [para. 0030] “The subscription service [double subscription service] ... initiate streaming .... to a first device ... based on a first subscription status associated with the first device [first subscription service] ... initiate streaming ... to a second device ... based on a second subscription status associated with the second device [second subscription service, making it a double subscription service]”) an/the intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Rajewski to include providing a double subscription service; and an/the intermediary subscription service nested within the double subscription service. One of ordinary skill in the art would have been motivated to make this modification because in doing so, the managers of applications which utilizes such an architecture can save money and resources because they are only paying for when operations are actually occurring and allow scaling of resources based on demand. (Rajewski, para. 0046) As per claim 2, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong also teaches further comprising first publishing the event notification to all subscribers associated with the graph. ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the first event notification] when new information comes in that match their subscriptions”; [para. 0046] “a client can create a subscription for ... all Persons”; [para. 0146] “all alerts can automatically be sent [first publishing the event notification] as request to all participating [to all subscribers associated with the graph]”) Armstrong in view of Carbune does not clearly teach publishing the event notification via the double subscription service. However, Rajewski teaches publishing the event notification via the double subscription service. ([Rajewski, para. 0015] “the subscription service [via the double subscription service as explained above] ... issue a notification to end-users of the consumer app [publish the event notification] ... the final receivers of the live stream content”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong in view of Carbune with the teachings of Rajewski to include publishing the event notification via the double subscription service. One of ordinary skill in the art would have been motivated to make this modification because in doing so, the subscription service can scale upwards and downwards and provide a rich environment for analytics, operations/processes, and data mining. (Rajewski, para. 0049) As per claim 3, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong also teaches further comprising second publishing the event notification to a subscriber associated with the subgroup using the intermediary subscription service. ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the event notification] when new information comes in that match their subscriptions [to a subscriber using the intermediary subscription service]”; [para. 0046] “a client can create a subscription [intermediary subscription service] for ... all Persons who are Members Of any organization”; [para. 0097] “The alerts [second publishing the event notification] can be sent discretely to only members of a specific team ... only those officers/agents who can assist [a subscriber associated with the subgroup] would be notified”) Armstrong in view of Carbune does not clearly teach the intermediary subscription service nested within the double subscription service. However, Rajewski the intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune and Rajewski for the same reasons as disclosed above. As per claim 4, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong also teaches further comprising publishing the event notification to subscribers associated with the graph using both the subscription service and the intermediary subscription service. ([Armstrong, para. 0152] “Features of the disclosed embodiments can be combined”; [para. 0097] “produce a variety of alerts [publishing the event notifications] ... as varying as the users who access the network [to subscribers associated with the graph] ... It can provide different types of alerts based upon user needs” [para. 0046] “Subscriptions in the semantic server can be dynamic, in that, for example, new information can be routed [publishing the event notification] to applicable subscriptions [using both the subscription service and the intermediary subscription service]”) Armstrong in view of Carbune does not clearly teach publishing the event notification to subscribers using the double subscription service and the intermediary subscription service nested within the double subscription service. However, Rajewski teaches publishing the event notification to subscribers using the double subscription service ([Rajewski, para. 0015] “the subscription service [using the double subscription service as explained above] ... issue a notification to end-users of the consumer app [publish the event notification] ... the final receivers of the live stream content”) and the intermediary subscription service nested within the double subscription service. ([Para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber] view ... events [publishing the event notification]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune and Rajewski for the same reasons as disclosed above. As per claim 5, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong also teaches further comprising cyclically updating the graph using the intermediary subscription service. ([Armstrong, para. 0059] “subscriptions can continuously maintain information about the data [updating the graph] meeting certain logical criteria and the criteria themselves can also be dynamic ... a subscription ... with relation “near” a specific ... concept [intermediary subscription service as it is a subset of a node/concept] ... be updated at regular intervals [cyclically updating the graph], which can automatically trigger re-computation of the concepts that match the subscription at each update) Armstrong does not clearly teach the intermediary subscription service nested within the double subscription service. However, Rajewski teaches the intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune and Rajewski for the same reasons as disclosed above. As per claim 6, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong also teaches further comprising comparing the event notification to a constraint associated with the intermediary subscription service. ([Armstrong, para. 0050] “Subscriptions can allow clients to be notified of information changes of interest [event notification] ... Subscriptions [associated with the intermediary subscription service] ... can be chained together to create dynamic subscriptions with high-order set constraints ... The elements at the intersection [items of interest/events] of those sets can satisfy the constraints [comparing to a constraint associated with the intermediary service] and can be of interest to the clients [comparing the event notification as items of interest are sent as a notification to the client]”) Armstrong in view of Carbune does not clearly teach the intermediary subscription service nested within the double subscription service. However, Rajewski teaches the intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune and Rajewski for the same reasons as disclosed above. As per claim 7, Armstrong in view of Carbune and Rajewski teaches claim 1. Armstrong in view of Rajewski does not clearly teach further comprising terminating the intermediary subscription service in response to a constraint. However, Carbune teaches further comprising terminating the intermediary subscription service in response to a constraint. ([Carbune, para. 0073] “an event type of a developing event [a constraint as it is a requisite for a user to subscribe] ... used to determine whether to subscribe particular individuals”; [para. 0078] “a developing event and its event-specific provisional knowledge graph 139 [the intermediary subscription service] may be assigned multiple candidate event types [constraints] ... once the developing is reclassified as a different event type [in response to a change of constraint, and so in response to a constraint] of which the individual is not interested, the individual may be unsubscribed [terminating the intermediary subscription service]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong in view of Rajewski with the teachings of Carbune to include further comprising terminating the intermediary subscription service in response to a constraint. One of ordinary skill in the art would have been motivated to make this modification because in doing so, this allows information to be added to a knowledge graph once the information is sufficiently corroborated, allowing for individuals to decide whether they wish to continue receiving updates. (Carbune, para. 0046; and para. 0090) As per claim 8, Armstrong teaches at least one computer system that publishes an event notification, comprising: ([Armstrong, para. 0009] “FIG. 1 illustrates an overview of a system [computer system] for implementing ... embodiments of the disclosed subject matter”; [para. 0021] “The semantic server [the computer system] can alert clients [publishes an event notification] when new information comes in that match their subscriptions”) at least one central processing unit; and ([Armstrong, para. 0151] “Various servers and clients disclosed herein, can include ... processors”) at least one memory device storing instructions that, when executed by the at least one central processing unit, perform operations, the operations comprising: ([Armstrong, para. 0151] “Various servers and clients disclosed herein, can include ... memories ... the memories contain storage devices for storing programs and/or software modules for controlling the processors or performing methods, for example, those methods described herein”) associating the event notification to a graph having nodes; ([Armstrong, para. 0020] “the semantic server can store ... concept instances and relations as nodes and edges in a semantic graph [graph having nodes]”; [para. 0021] “Clients can specify subscriptions of interest over data in the semantic graph ... As the semantic graph changes [to a graph having nodes], the semantic server can alert [associate the event notification] clients when new information comes in that match their subscriptions”) associating the event notification to a subgroup of the nodes; ([Armstrong, para. 0026] “clients ... can subscribe to the portions [subgroup] of the semantic graph [of the graphical nodes associated with the graph] that are currently of interest to their clients”; [para. 0046] “For example, a client can create a subscription for ... all Persons who are Members Of any organization [subgroup of the nodes]”; [para. 0021] “the semantic server can alert [associate the event notification] clients when new information comes in that match their subscriptions [to a subgroup of the nodes”) first publishing the event notification using a subscription service to all subscribers associated with the graph; and ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the first event notification] when new information comes in that match their subscriptions”; [para. 0046] “a client can create a subscription for ... all Persons”; [para. 0146] “all alerts can automatically be sent [first publishing the event notification] as request to all participating [to all subscribers associated with the graph]”) second publishing the event notification using an intermediary subscription service to a subscriber subgroup of the subscribers associated with the subgroup of the nodes. ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the event notification] when new information comes in that match their subscriptions [to a subscriber using the intermediary subscription service]”; [para. 0046] “a client can create a subscription [intermediary subscription service] for ... all Persons who are Members Of any organization”; [para. 0097] “The alerts [second publishing the event notification] can be sent discretely to only members of a specific team ... only those officers/agents who can assist [a subscriber associated with the subgroup] would be notified”) Armstrong does not clearly teach publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. However, Carbune teaches an intermediary subscription service nested within the subscription service. ([Carbune, para. 0007] “an individual that issues a query about the developing event ... may effectively cause that individual to be “subscribed” to receiving updates from the event-specific provisional knowledge graph [an intermediary subscription service] ... In other cases, individuals may be subscribed to receive updates on developing events automatically ... based on those individuals' interests aligning with event “types” of the developing events”; [para. 0059] “knowledge graph 138 [the subscription service], may be leveraged to quickly disseminate new information about the developing event to interested users”; [para. 0045] "event-specific provisional knowledge graph 139 may be implemented ... by provisional knowledge graph manager 136 [by the computer system – see para. 0037 and Fig. 1: “Knowledge system 130 may include one or more computing devices”], as a layer on top of [nested within] general-purpose knowledge graph 138”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Carbune to include an intermediary subscription service nested within the subscription service. One of ordinary skill in the art would have been motivated to make this modification because the event-specific provisional knowledge graph in combination with the general-purpose knowledge graph allows the computer device to automatically present event-specific information associated with the entity in an appropriate format. (Carbune, para. 0003) Armstrong in view of Carbune does not clearly teach publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. However, Rajewski teaches publishing the event notification using a double subscription service; and ([Rajewski, para. 0015] “the subscription service [using the double subscription service as explained above] ... issue a notification to end-users of the consumer app [publish the event notification] ... the final receivers of the live stream content”) an intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Rajewski to include publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. One of ordinary skill in the art would have been motivated to make this modification because in doing so, the managers of applications which utilizes such an architecture can save money and resources because they are only paying for when operations are actually occurring and allow scaling of resources based on demand, and in doing so, the subscription service can scale upwards and downwards and provide a rich environment for analytics, operations/processes, and data mining. (Rajewski, para. 0046 and para. 0049) As per claim 9, the claim language is identical or substantially similar to that of claim 5. Therefore, it is rejected under the same rationale applied to claim 5. As per claim 11, the claim language is identical or substantially similar to that of claim 6. Therefore, it is rejected under the same rationale applied to claim 6. As per claim 12, Armstrong in view of Carbune and Rajewski teaches claim 11. Armstrong also teaches wherein the operations further comprise determining the event notification satisfies the constraint associated with the intermediary subscription service. ([Armstrong, para. 0050] “Subscriptions can allow clients to be notified of information changes of interest [event notification] ... Subscriptions [associated with the intermediary subscription service] ... can be chained together to create dynamic subscriptions with high-order set constraints ... The elements at the intersection [items of interest/event notification] of those sets can satisfy the constraints [satisfies the constraint associated with the intermediary service] and can be of interest to the clients”) As per claim 13, Armstrong in view of Carbune and Rajewski teaches claim 12. Armstrong in view of Rajewski does not clearly teach wherein in response to the determining that the event notification satisfies the constraint associated with the intermediary subscription service, the operations further comprise ending the intermediary subscription service. However, Carbune teaches wherein in response to the determining that the event notification satisfies the constraint associated with the intermediary subscription service, the operations further comprise ending the intermediary subscription service. ([Carbune, para. 0073] “an event type [a constraint as it is a requisite for a user to subscribe] of a developing event as it is used to determine whether to subscribe particular individuals”; [para. 0078] “a developing event and its event-specific provisional knowledge graph 139 [the intermediary subscription service] may be assigned multiple candidate event types [constraints] ... an individual may receive updates about the developing event [event notifications] ... once the developing [event notification] is reclassified as a ... event type of which the individual is not interested, [satisfies a constraint] the individual may be unsubscribed [ending the intermediary subscription service]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong in view of Rajewski with the teachings of Carbune to include wherein in response to the determining that the event notification satisfies the constraint associated with the intermediary subscription service, the operations further comprise ending the intermediary subscription service. One of ordinary skill in the art would have been motivated to make this modification because in doing so, this allows information to be added to a knowledge graph once the information is sufficiently corroborated, allowing for individuals to decide whether they wish to continue receiving updates. (Carbune, para. 0046; and para. 0090) Claims 10 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Armstrong in view of Carbune and Rajewski as applied to claims 8 and 12 above and further in view of Ploegert et al. (US Pub. 2022/0368558) (hereinafter “Ploegert”). As per claim 10, Armstrong in view of Carbune and Rajewski teaches claim 8. Armstrong in view of Carbune and Rajewski does not clearly teach wherein the operations further comprise cyclically updating the graph via a reactive event notification loop. However, Ploegert teaches wherein the operations further comprise cyclically updating the graph via a reactive event notification loop. ([Ploegert, para. 0082] “graph projections ... a graph with nodes for the entities ... and edges for the relationships between the entities”; [para. 0137] “make updates to projections [graph] ... based on the enriched event [via a reactive event notification loop]”; [Fig. 30; para. 0286] “a system 3000 including an enrichment loop [reactive event notification loop] is shown”; [para. 0335] “consuming system events ... an alert”; the graph is updated based on the enriched event and Fig. 30 shows the enriched event is generated by the reactive event notification loop, which is reactive as it “reacts to events” [see para. 0302], uses event notifications/consuming system events and is a loop as shown in the figure) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong in view of Carbune and Rajewski with the teachings of Ploegert to include wherein the operations further comprise cyclically updating the graph via a reactive event notification loop. One of ordinary skill in the art would have been motivated to make this modification because such a technique would provide the benefit of continuous updating of messages/notifications which enables an application to have immediate access to contextual information of events without having to additionally query/subscribe to the system. (Ploegert, para. 0085) As per claim 14, Armstrong in view of Carbune and Rajewski teaches claim 12. Armstrong in view of Rajewski does not clearly teach wherein in response to the determining that the event notification satisfies the constraint associated with the intermediary subscription service, the operations further comprise terminating a reactive event notification loop. However, Carbune teaches wherein in response to the determining that the event notification satisfies the constraint associated with the intermediary subscription service, the operations further comprise terminating a reactive event. ([Carbune, para. 0073] “an event type [a constraint as it is a requisite for a user to subscribe] of a developing event as it is used to determine whether to subscribe particular individuals”; [para. 0078] “a developing event and its event-specific provisional knowledge graph 139 [the intermediary subscription service] may be assigned multiple candidate event types [constraints] ... an individual may receive updates about the developing event [event notifications] ... once the developing [event notification] is reclassified as a ... event type of which the individual is not interested, [satisfies a constraint] the individual may be unsubscribed [terminating a reactive event as the subscription generates a notification in reaction to a new event]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune and Rajewski for the same reasons as disclosed above. Armstrong in view of Carburn and Rajewski does not clearly teach the reactive event is a reactive event loop. However, Ploegert teaches the reactive event is a reactive event loop. ([Ploegert, para. 0082] “[Fig. 30; para. 0286] “a system 3000 including an enrichment loop [reactive event notification loop] is shown”; [para. 0302] “the enrichment loop [reactive event loop] ... react to event ... generate alerts [is a reactive event]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Carbune, Rajewski and Ploegert for the same reasons as disclosed above. Claims 15-16 and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Armstrong in view of Sankaran et al. (US Pub. 2025/0209156) (hereinafter “Sankaran”), in view of Carbune and in view of Rajewski. As per claim 15, Armstrong teaches a memory device storing instructions that, when executed by a central processing unit, perform operations, comprising: ([Armstrong, para. 0151] “Various servers and clients disclosed herein, can include ... memories ... the memories contain storage devices for storing programs and/or software modules for controlling the processors or performing methods, for example, those methods described herein”) first publishing the event notification using a subscription service to all subscribers associated with the graph; and ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the first event notification] when new information comes in that match their subscriptions”; [para. 0046] “a client can create a subscription for ... all Persons”; [para. 0146] “all alerts can automatically be sent [first publishing the event notification] as request to all participating [to all subscribers associated with the graph]”) second publishing the event notification using an intermediary subscription service to a subscriber subgroup of the subscribers associated with the subgroup of the nodes. ([Armstrong, para. 0021] “the semantic server can alert clients [publishing the event notification] when new information comes in that match their subscriptions [to a subscriber using the intermediary subscription service]”; [para. 0046] “a client can create a subscription [intermediary subscription service] for ... all Persons who are Members Of any organization”; [para. 0097] “The alerts [second publishing the event notification] can be sent discretely to only members of a specific team ... only those officers/agents who can assist [a subscriber associated with the subgroup] would be notified”; the event notification as a security event notification and cybersecurity subscribers are taught by Sankaran below; an intermediary subscription service nested within the subscription service is taught by Carbune below; an intermediary subscription service nested within the double subscription service is taught by Rajewski below) Armstrong does not clearly teach receiving a cybersecurity event notification associated with a cybersecurity service; associating the cybersecurity event notification to a cybersecurity threat graph having nodes; associating the cybersecurity event notification to a subgroup of the nodes; the event notification as a security event notification; cybersecurity subscribers associated with the cybersecurity threat graph; publishing the event notification to subscribers using the double subscription service; and an intermediary subscription service nested within the double subscription service. However, Sankaran teaches receiving a cybersecurity event notification associated with a cybersecurity service; ([Sankaran, para. 0052] “an alert is a positive detection of a security threat [cybersecurity alert notification] by a cyber security detector [associated with a cybersecurity service]”; [para. 0054] “At step S3, an MGM is provided with [receives] a security incident prompt comprising the alert”) associating the cybersecurity event notification to a cybersecurity threat graph having nodes; ([Sankaran, para. 0024; Fig. 5] “A security graph [cybersecurity threat graph having nodes] ... created in response to ... an ‘alert’ ... An alert node may be created, and the graph [to a cybersecurity threat graph having nodes] built by connecting related entities to the alert [associating the cybersecurity event notification]”) associating the cybersecurity event notification to a subgroup of the nodes; ([Sankaran, para. 0026] “The generative ML model is prompted to initially map each alert [associating the cybersecurity event notification] to a subset of one or more entities [to a subgroup of the nodes]”) the event notification as a security event notification; and ([Sankaran, para. 0052] “the detection of a potentially malicious entity such as a malware pattern [security event notification] ... referred to as an ‘alert’ [event notification]”) cybersecurity subscribers associated with the cybersecurity threat graph. ([Sankaran, para. 0025] “Security incident graphs [cybersecurity threat graphs] are useful in enabling [associated with] security analysts ... cybersecurity analysts engage with [subscribe to] the security incident graphs”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Sankaran to include receiving a cybersecurity event notification associated with a cybersecurity service; associating the cybersecurity event notification to a cybersecurity threat graph having nodes; associating the cybersecurity event notification to a subgroup of the nodes; the event notification as a security event notification; cybersecurity subscribers associated with the cybersecurity threat graph. One of ordinary skill in the art would have been motivated to make this modification because such a technique would provide the benefit of reducing reliance on human analysis, and so increase speed of analysis and generally improve security. (Sankaran, para. 0020) Armstrong in view of Sankaran does not clearly teach publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. However, Carbune teaches an intermediary subscription service nested within the subscription service. ([Carbune, para. 0007] “an individual that issues a query about the developing event ... may effectively cause that individual to be “subscribed” to receiving updates from the event-specific provisional knowledge graph [an intermediary subscription service] ... In other cases, individuals may be subscribed to receive updates on developing events automatically ... based on those individuals' interests aligning with event “types” of the developing events”; [para. 0059] “knowledge graph 138 [the subscription service], may be leveraged to quickly disseminate new information about the developing event to interested users”; [para. 0045] "event-specific provisional knowledge graph 139 may be implemented ... by provisional knowledge graph manager 136 [by the computer system – see para. 0037 and Fig. 1: “Knowledge system 130 may include one or more computing devices”], as a layer on top of [nested within] general-purpose knowledge graph 138”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong in view of Sankaran with the teachings of Carbune to include intermediary subscription service nested within the subscription service. One of ordinary skill in the art would have been motivated to make this modification because the event-specific provisional knowledge graph in combination with the general-purpose knowledge graph allows the computer device to automatically present event-specific information associated with the entity in an appropriate format. (Carbune, para. 0003) Armstrong in view of Sankaran and Carbune does not clearly teach publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. However, Rajewski teaches publishing the event notification using a double subscription service; and ([Rajewski, para. 0015] “the subscription service [using the double subscription service as explained above] ... issue a notification to end-users of the consumer app [publish the event notification] ... the final receivers of the live stream content”) an intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to have modified the elements disclosed by Armstrong with the teachings of Rajewski to include publishing the event notification using a double subscription service; and an intermediary subscription service nested within the double subscription service. One of ordinary skill in the art would have been motivated to make this modification because in doing so, the managers of applications which utilizes such an architecture can save money and resources because they are only paying for when operations are actually occurring and allow scaling of resources based on demand, and in doing so, the subscription service can scale upwards and downwards and provide a rich environment for analytics, operations/processes, and data mining. (Rajewski, para. 0046 and para. 0049) As per claim 16, Armstrong in view of Sankaran, Carbune and Rajewski teaches claim 15. Armstong also teach wherein the operations further comprise cyclically updating the graph using the intermediary subscription service. ([Armstrong, para. 0059] “subscriptions can continuously maintain information about the data [updating the graph] meeting certain logical criteria and the criteria themselves can also be dynamic ... a subscription ... with relation “near” a specific ... concept [intermediary subscription service as it is a subset of a node/concept] ... be updated at regular intervals [cyclically updating the graph], which can automatically trigger re-computation of the concepts that match the subscription at each update) Armstrong does not clearly teach the graph is the cybersecurity threat graph; and an intermediary subscription service nested within the subscription service. However, Sankaran teaches the graph is the cybersecurity threat graph. ([Sankaran, para. 0024; Fig. 5] “A security graph ... created in response to a positive threat detection ... the detection of a potentially malicious entity such as a malware pattern [cybersecurity threat]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong and Sankaran for the same reasons as disclosed above. Armstrong in view of Sankaran does not clearly teach the intermediary subscription service nested within the subscription service. However, Carbune teaches the intermediary subscription service nested within the subscription service. ([Carbune, para. 0007] “an individual that issues a query about the developing event ... may effectively cause that individual to be “subscribed” to receiving updates from the event-specific provisional knowledge graph [an intermediary subscription service] ... In other cases, individuals may be subscribed to receive updates on developing events automatically ... based on those individuals' interests aligning with event “types” of the developing events”; [para. 0059] “knowledge graph 138 [the subscription service], may be leveraged to quickly disseminate new information about the developing event to interested users”; [para. 0045] "event-specific provisional knowledge graph 139 may be implemented ... by provisional knowledge graph manager 136 [by the computer system – see para. 0037 and Fig. 1: “Knowledge system 130 may include one or more computing devices”], as a layer on top of [nested within] general-purpose knowledge graph 138”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran and Carbune for the same reasons as disclosed above. Armstrong in view of Sankaran and Carbune does not clearly teach an intermediary subscription service nested within the double subscription service. However, Rajewski teaches an intermediary subscription service nested within the double subscription service. ([Rajewski, para. 0019] “The subscription service [double subscription service] can also provide services [a nested service as it is a service provided by the double service] to allow the subscribers to view ... events [an intermediary subscription service, as it is a subscription service that acts as a middle man between the subscription service and the subscriber]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune and Rajewski for the same reasons as disclosed above. As per claim 18, Armstrong in view of Sankaran, Carbune and Rajewski teaches claim 15. Armstrong also teaches wherein the operations further comprise comparing the event notification to constraint associated with the intermediary subscription service. ([Armstrong, para. 0050] “Subscriptions can allow clients to be notified of information changes of interest [event notification] ... Subscriptions [associated with the intermediary subscription service] ... can be chained together to create dynamic subscriptions with high-order set constraints ... The elements at the intersection [items of interest/events] of those sets can satisfy the constraints [comparing to a constraint associated with the intermediary service] and can be of interest to the clients [comparing the event notification as items of interest are sent as a notification to the client]”) Armstrong in view of Carbune and Rajewski does not clearly teach the event notification is a cybersecurity event notification. However, Sankaran teaches the event notification is a cybersecurity event notification. ([Sankaran, para. 0052] “the detection of a potentially malicious entity such as a malware pattern [security event notification] ... referred to as an ‘alert’ [event notification]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune and Rajewski for the same reasons as disclosed above. As per claim 19, Armstrong in view of Sankaran, Carbune and Rajewski teaches claim 18. Armstrong also teaches wherein the operations further comprise determining the event notification satisfies the constraint associated with the intermediary subscription service. ([Armstrong, para. 0050] “Subscriptions can allow clients to be notified of information changes of interest [event notification] ... Subscriptions [associated with the intermediary subscription service] ... can be chained together to create dynamic subscriptions with high-order set constraints ... The elements at the intersection [items of interest/event notification] of those sets can satisfy the constraints [satisfies the constraint associated with the intermediary service] and can be of interest to the clients”) Armstrong in view of Carbune and Rajewski does not clearly teach the event notification is a cybersecurity event notification. However, Sankaran teaches the event notification is a cybersecurity event notification. ([Sankaran, para. 0052] “the detection of a potentially malicious entity such as a malware pattern [security event notification] ... referred to as an ‘alert’ [event notification]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune and Rajewski for the same reasons as disclosed above. As per claim 20, Armstrong in view of Sankaran, Carbune and Rajewski teaches claim 18. Armstrong also teaches determining that the event notification fails to satisfy the constraint associated with the intermediary subscription service; and ([Armstrong, para. 0114] “create a page with alerts ... in semantic computing application server [intermediary subscription service] that requests alerts [event notification] for those foreign nationals traveling on student visas who arrived less than 30 days prior to traveling to a destination more than six driving hours from their expected place of residence [the constraint associated with the intermediary subscription service]”; this is an intermediary subscription service as the concept is a subset of “all Persons” which was the top level subscription service; [para. 0116] “A woman in her early 20s enters the country ... She is traveling on a student visa and documentation verifies her status as a graduate student at Sacramento State in California ... this is a new entry [fails to satisfy the constraint of “who arrived less than 30 days prior to traveling to a destination more than six hours from their expected place of residence”]”) declining to publish the event notification using the intermediary subscription service. ([Armstrong, para. 0116] “semantic computing application server that requests alerts [the intermediary subscription service] ... No alerts are presented [declining to public the event notification] at the time of entry as this is a new entry”) Armstrong in view of Carbune and Rajewski does not clearly teach the event notification is a cybersecurity event notification. However, Sankaran teaches the event notification is a cybersecurity event notification. ([Sankaran, para. 0052] “the detection of a potentially malicious entity such as a malware pattern [security event notification] ... referred to as an ‘alert’ [event notification]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune and Rajewski for the same reasons as disclosed above. Claim 17 is rejected under 35 U.S.C. 103 as being unpatentable over Armstrong in view of Sankaran, Carbune and Rajewski as applied to claim 15 above and further in view of Ploegert. As per claim 17, Armstrong in view of Sankaran, Carbune and Rajewski teaches claim 15. Armstrong in view of Carbune and Rajewski does not clearly teach the graph is the cybersecurity threat graph. However, Sankaran teaches the graph is the cybersecurity threat graph. ([Sankaran, para. 0024; Fig. 5] “A security graph ... created in response to a positive threat detection ... the detection of a potentially malicious entity such as a malware pattern [cybersecurity threat]”) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune and Rajewski for the same reasons as disclosed above. Armstrong in view of Sankaran, Carbune and Rajewski does not clearly teach wherein the operations further comprise cyclically updating the graph via a reactive event notification loop. However, Ploegert teaches wherein the operations further comprise cyclically updating the graph via a reactive event notification loop. ([Ploegert, para. 0082] “graph projections ... a graph with nodes for the entities ... and edges for the relationships between the entities”; [para. 0137] “make updates to projections [graph] ... based on the enriched event [via a reactive event notification loop]”; [Fig. 30; para. 0286] “a system 3000 including an enrichment loop [reactive event notification loop] is shown”; [para. 0335] “consuming system events ... an alert”; the graph is updated based on the enriched event and Fig. 30 shows the enriched event is generated by the reactive event notification loop, which is reactive as it “reacts to events” [see para. 0302], uses event notifications/consuming system events and is a loop as shown in the figure) It would have been obvious before the effective filing date of the claimed invention for one of ordinary skill in the art to combine the teachings of Armstrong, Sankaran, Carbune, Rajewski and Ploegert for the same reasons as disclosed above. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: Verlaan et al. (US Pub. 2019/0260601) discloses fulfilling a second subscription results in a first notification being transmitted, and fulfilling a fourth subscription results in a second notification. Donovan et al. (US Pub. 2005/0283477) discloses aggregating multiple subscriptions and sending a single notify messages to event consumers having an active subscription that reflect the same view, but if not sharing matching views, sending separate notification messages that reflect the different views. Botwick et al. (US Pub. 2022/0012227) discloses a multiple subscription management system where a first alert is generated based on a satisfying the criterion specified in the first subscription and a second alert generated based on satisfying a criterion specified in the second subscription. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to ZHE LIU whose telephone number is (571) 272-3634. The examiner can normally be reached on Monday - Friday: 8:30 AM to 5:30 PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached on (571) 272-3862. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at (866) 217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call (800) 786-9199 (IN USA OR CANADA) or (571) 272-1000. /Z.L./Examiner, Art Unit 2493 /CARL G COLIN/Supervisory Patent Examiner, Art Unit 2493
Read full office action

Prosecution Timeline

Mar 01, 2024
Application Filed
Sep 08, 2025
Non-Final Rejection — §103
Nov 12, 2025
Applicant Interview (Telephonic)
Nov 12, 2025
Examiner Interview Summary
Dec 06, 2025
Response Filed
Mar 17, 2026
Final Rejection — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12602469
FUSE BASED REPLAY PROTECTION WITH AGGRESSIVE FUSE USAGE AND COUNTERMEASURES FOR FUSE VOLTAGE CUT ATTACKS
2y 5m to grant Granted Apr 14, 2026
Patent 12585764
MALICIOUS BEHAVIOR DETECTION AND MITIGATION IN A DOCUMENT EXECUTION ENVIRONMENT
2y 5m to grant Granted Mar 24, 2026
Patent 12572644
MICRO-ENCLAVES FOR INSTRUCTION-SLICE-GRAINED CONTAINED EXECUTION OUTSIDE SUPERVISORY RUNTIME
2y 5m to grant Granted Mar 10, 2026
Patent 12572649
METHOD FOR PROTECTION FROM CYBER ATTACKS TO A VEHICLE BASED UPON TIME ANALYSIS, AND CORRESPONDING DEVICE
2y 5m to grant Granted Mar 10, 2026
Patent 12566851
DETECTING AND ASSESSING EVIDENCE OF MALWARE INTRUSION
2y 5m to grant Granted Mar 03, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

3-4
Expected OA Rounds
71%
Grant Probability
99%
With Interview (+59.0%)
3y 2m
Median Time to Grant
Moderate
PTA Risk
Based on 136 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month