DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Terminal Disclaimer
The terminal disclaimer filed on February 5, 2026 disclaiming the terminal portion of any patent granted on this application which would extend beyond the expiration date of U.S. Patent 12,095,786 has been reviewed and is accepted. The terminal disclaimer has been recorded.
Attempted Compact Prosecution
Upon further consideration of the cited reference of Lecroart, US 2025/0111095, the Examiner constructed a rejection to present to the Applicant in an attempt to compact prosecution on March 17, 2026. The Applicant’s representative Michael Ben-Shimon did not agree with the Examiner’s application of Lecroart, prosecution is hereby being reopened based upon the new grounds of the rejection.
Allowable Subject Matter
The indicated allowability of claims 1-17 are withdrawn in view of the reconsideration of reference to Lecroart, US 2025/0111095. Rejections based on the newly cited reference follow.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-6, 8-15, and 17 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Lecroart, US 2025/0111095 (cited in the Non-Final Office action mailed November 5, 2025).
As per claim 1, it is taught of a method for generating a remediation action in a computing environment based on a cybersecurity inspection, comprising:
inspecting a computing environment for a cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (via inspection) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
detecting a cybersecurity issue in the computing environment based on detection of the cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (i.e., detecting a cybersecurity issue) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
generating an input for a generative artificial intelligence (Al) remediator based on the detected cybersecurity issue, wherein the generative Al remediator is configured to generate an output including a remediation action based on the input (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (i.e., generative artificial intelligence (AI) remediator), said correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue) comprising at least the runtime report, paragraph 0017); and
initiating the remediation action in the computing environment (when the similarity measurement is above the acceptability threshold, submitting the configuration file correction recommendation for user evaluation (i.e., initiating the remediation action in the computing environment for review), paragraph 0019).
As per claim 2, it is disclosed of further comprising:
generating a prompt as the input, the prompt provided to a language model (LM) of the generative Al remediator (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (of the LLM type (i.e., generative AI remediator of a language model (LM))), said correction request comprising a question formulated in natural language and anomaly context information, paragraph 0049).
As per claim 3, it is taught of further comprising:
generating a representation of the computing environment in a security database, the security database including a representation schema (context information (i.e., representation schema) specific to the detected anomaly is obtained, the context information comprises the runtime report LOG produced by the anomaly detection tool comprising the configuration file SCP that generated the anomaly, see paragraph 0098).
As per claim 4, it is disclosed wherein the prompt is generated based on any one of:
obtaining and storing in memory a runtime report comprising a compliance anomaly detected (i.e., detecting a cybersecurity issue) in the configuration file while said service is being run, paragraph 0016 and context information (i.e., representation schema) specific to the detected anomaly is obtained, the context information comprises the runtime report LOG produced by the anomaly detection tool comprising the configuration file SCP that generated the anomaly, see paragraph 0098).
As per claim 5, it is taught of further comprising:
generating the input further based on a predefined remediation action (correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue) comprising at least the runtime report, paragraph 0017).
As per claim 6, it is disclosed of further comprising:
generating a plurality of remediation actions, each remediation action including a priority value (a score (i.e., priority value) is assigned to this new example and stored in memory, this score (i.e., priority value) corresponds to or is awarded on the basis of a rating assigned by the person who evaluated the recommendation RECO, this rating has been awarded in accordance with a given rating grid, which defines the conditions for awarding each rating in the grid. For example, the highest rating is awarded when the recommendation RECO enables full remediation of the anomaly, see paragraph 0119); and
generating a visual representation of each remediation action based on the priority value (once this new REQ′/RECO′ pair has been obtained, the evaluator assigns it a score. In E13, the set formed by the request, the corrected recommendation and the evaluator's score is obtained by device. It is stored in E12 as a new example, for example in the table QDB#i (i.e., generated visual representation), and the updating of the configuration file SCP in the IaC repository RPY is triggered in E11, see paragraph 0120).
As per claim 8, it is disclosed of further comprising:
receiving a selection of a preferred computing platform of a plurality of computing platforms of the computing environment (an overall architecture of a platform PTF for managing a computing environment infrastructure using a set of IaC software programs, according to one or more embodiments of the invention. The computing environment in question is a distributed cloud computing environment. It is assumed that this environment is built from infrastructure elements and resources (i.e., plurality of computing platforms of the computing environment) supplied by a cloud provider CP, whether public or private, with a view to implementing a computing project, such as a company's computing environment, paragraph 0069);
configuring the generative Al remediator to generate the output including the remediation action further based on the received selection of the preferred computing platform (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (i.e., generative artificial intelligence (AI) remediator), said correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue specific to the computing platform (paragraph 0069)) comprising at least the runtime report, paragraph 0017).
As per claim 9, it is taught of a non-transitory computer-readable medium storing a set of instructions for generating a remediation action in a computing environment based on a cybersecurity inspection, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device (paragraph 0174) to:
inspect a computing environment for a cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (via inspection) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
detect a cybersecurity issue in the computing environment based on detection of the cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (i.e., detecting a cybersecurity issue) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
generate an input for a generative artificial intelligence (Al) remediator based on the detected cybersecurity issue, wherein the generative Al remediator is configured to generate an output including a remediation action based on the input (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (i.e., generative artificial intelligence (AI) remediator), said correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue) comprising at least the runtime report, paragraph 0017); and
initiate the remediation action in the computing environment (when the similarity measurement is above the acceptability threshold, submitting the configuration file correction recommendation for user evaluation (i.e., initiating the remediation action in the computing environment for review), paragraph 0019).
As per claim 10, it is disclosed of a system for generating a remediation action in a computing environment based on a cybersecurity inspection comprising:
one or more processors (paragraph 0174) configured to:
inspect a computing environment for a cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (via inspection) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
detect a cybersecurity issue in the computing environment based on detection of the cybersecurity object (obtaining and storing in memory a runtime report comprising a compliance anomaly detected (i.e., detecting a cybersecurity issue) in the configuration file (i.e., computing environment) while said service (i.e., cybersecurity object) is being run, paragraph 0016);
generate an input for a generative artificial intelligence (AI) remediator based on the detected cybersecurity issue, wherein the generative Al remediator is configured to generate an output including a remediation action based on the input (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (i.e., generative artificial intelligence (AI) remediator), said correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue) comprising at least the runtime report, paragraph 0017); and
initiate the remediation action in the computing environment (when the similarity measurement is above the acceptability threshold, submitting the configuration file correction recommendation for user evaluation (i.e., initiating the remediation action in the computing environment for review), paragraph 0019).
As per claim 11, it is taught wherein the one or more processors are further configured to:
generate a prompt as the input, the prompt provided to a language model (LM) of the generative Al remediator (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (of the LLM type (i.e., generative AI remediator of a language model (LM))), said correction request comprising a question formulated in natural language and anomaly context information, paragraph 0049).
As per claim 12, it is disclosed wherein the one or more processors are further configured to:
generate a representation of the computing environment in a security database, the security database including a representation schema (context information (i.e., representation schema) specific to the detected anomaly is obtained, the context information comprises the runtime report LOG produced by the anomaly detection tool comprising the configuration file SCP that generated the anomaly, see paragraph 0098).
As per claim 13, it is taught wherein the prompt is generated based on any one of:
obtaining and storing in memory a runtime report comprising a compliance anomaly detected (i.e., detecting a cybersecurity issue) in the configuration file while said service is being run, paragraph 0016 and context information (i.e., representation schema) specific to the detected anomaly is obtained, the context information comprises the runtime report LOG produced by the anomaly detection tool comprising the configuration file SCP that generated the anomaly, see paragraph 0098).
As per claim 14, it is disclosed wherein the one or more processors are further configured to:
generate the input further based on a predefined remediation action (correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue) comprising at least the runtime report, paragraph 0017).
As per claim 15, it is taught wherein the one or more processors are further configured to:
generate a plurality of remediation actions, each remediation action including a priority value (a score (i.e., priority value) is assigned to this new example and stored in memory, this score (i.e., priority value) corresponds to or is awarded on the basis of a rating assigned by the person who evaluated the recommendation RECO, this rating has been awarded in accordance with a given rating grid, which defines the conditions for awarding each rating in the grid. For example, the highest rating is awarded when the recommendation RECO enables full remediation of the anomaly, see paragraph 0119); and
generate a visual representation of each remediation action based on the priority value (once this new REQ′/RECO′ pair has been obtained, the evaluator assigns it a score. In E13, the set formed by the request, the corrected recommendation and the evaluator's score is obtained by device. It is stored in E12 as a new example, for example in the table QDB#i (i.e., generated visual representation), and the updating of the configuration file SCP in the IaC repository RPY is triggered in E11, see paragraph 0120).
As per claim 17, it is disclosed wherein the one or more processors are further configured to:
receive a selection of a preferred computing platform of a plurality of computing platforms of the computing environment (an overall architecture of a platform PTF for managing a computing environment infrastructure using a set of IaC software programs, according to one or more embodiments of the invention. The computing environment in question is a distributed cloud computing environment. It is assumed that this environment is built from infrastructure elements and resources (i.e., plurality of computing platforms of the computing environment) supplied by a cloud provider CP, whether public or private, with a view to implementing a computing project, such as a company's computing environment, paragraph 0069); and
configure the generative Al remediator to generate the output including the remediation action further based on the received selection of the preferred computing platform (presenting an anomaly correction request as input to a previously trained generative artificial intelligence model (i.e., generative artificial intelligence (AI) remediator), said correction request (i.e., remediation) comprising a question formulated (i.e., generating an input) in natural language (i.e., generative AI remediator) and anomaly context information (i.e., based upon the detected cybersecurity issue specific to the computing platform (paragraph 0069)) comprising at least the runtime report, paragraph 0017).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 7 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Lecroart, US 2025/0111095 (cited in the Non-Final Office action mailed November 5, 2025) in view of Zafar, US 2023/0300166 (cited in the Information Disclosure Statement filed on August 9, 2024).
As per claims 7 and 16, Lecroart fails to disclose:
generating a plurality of remediation actions, each remediation action directed to a computing platform of a plurality of computing platforms of the computing environment, each computing platform associated with the detected cybersecurity issue; and
receiving a selection of a first remediation action of the plurality of remediation actions, wherein the first remediation action, when initiated, remediates the cybersecurity issue.
Zafar discloses:
generating a plurality of remediation actions, each remediation action directed to a computing platform of a plurality of computing platforms of the computing environment, each computing platform associated with the detected cybersecurity issue (each distinct automated remediation capability of the automated remediations (i.e., plurality of remediation actions) service may correspond to a distinct automated remediation action type (e.g., a first automated remediation capability of the automated remediations microservice may correspond to containing compromised hosts (i.e., plurality of computing platforms), a second automated remediation capability of the automatic remediation service may correspond to blocking bad hashes, etc.), paragraph 0072); and
receiving a selection of a first remediation action of the plurality of remediation actions, wherein the first remediation action, when initiated, remediates the cybersecurity issue (a system or service implementing the method may function to generate one or more remediation actions and/or one or more mitigation actions that may cause an automatic remediation or mitigation of compromised digital assets of a target subscriber based on the event/alert data, when applicable (i.e., selection of a first remediation), paragraph 0056 and each distinct automated remediation capability of the automated remediations (i.e., plurality of remediation actions) service may correspond to a distinct automated remediation action type (e.g., a first automated remediation capability of the automated remediations microservice may correspond to containing compromised hosts (i.e., plurality of computing platforms), a second automated remediation capability of the automatic remediation service may correspond to blocking bad hashes, etc.), paragraph 0072).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to have been motivated to apply selective remediations that are particular to resolving a certain detected cybersecurity issue. Zafar discloses of an automated remediation microservice functioning to automatically remediate (or mitigate), in real-time or near real-time, cybersecurity alerts/events exceeding a threat severity threshold and/or automatically remediate (or mitigate) cybersecurity events/alerts that may have been promoted to an incident severity level (e.g., confirmed cybersecurity threat) based on the results or findings of one or more cybersecurity investigations, see paragraph 0062. Although the teachings of Lecroart disclose of a remediation service, the teachings of Zafar offer a remediation service that selects from a plurality of remediations that occur in real-time, or near real-time to quickly protect a system from a detected cybersecurity event that carries a high incident security level.
Conclusion
The relevant art made of record and not relied upon is considered pertinent to applicant's disclosure.
Cimijotti et al, US 2026/0044608 is relied upon for a generative artificial intelligence engine, a data extraction and filtration application, an input validation application, a rating generation application, a remediation application, an impact assessment application, and a data repository comprising any data processed or accessed by one or more applications in the memory device. The computer-executable program code of the network provisioning application, the generative artificial intelligence engine, the data extraction and filtration application, the input validation application, the rating generation application, the remediation application, and the impact assessment application may instruct the processing device to perform certain logic, data-processing, and data-storing functions of the vulnerability identification system, see paragraph 0034.
Sommers et al, US 2024/0378395 is relied upon for disclosing of a test case or plan generated using LLM output is not what user expected or desired, user can provide feedback indicating deficiencies or issues. In this example, the feedback may be used by LAM to improve LCB or related functionality, e.g., by adding or changing logic for correcting or mitigating identified deficiencies or issues in subsequently generated test plans using LLM output, see paragraph 0031.
Mondlock, U.S. Patent 12,020,140 is relied upon for disclosing of resilient RAG pipelines services additionally include functionality to monitor the prompts sent to the LLMs and the responses received from the LLMs to identify and remediate prompt failure events. Thus, in some embodiments, the resilient RAG pipeline services include a trunk service configured to identify times prompts are sent to LLMs and cause the prompts to be resent if an LLM either sends no response or an incomplete response during appropriate time limits, see column 25, lines 53-62.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER REVAK whose telephone number is (571)272-3794. The examiner can normally be reached 5:30am - 3:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Catherine Thiaw can be reached at 571-270-1138. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHRISTOPHER A REVAK/Primary Examiner, Art Unit 2407
Prosecution Insights