DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Drawings
Figure 8 should be designated by a legend such as --Prior Art-- because only that which is old is illustrated. See MPEP § 608.02(g). Corrected drawings in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. The replacement sheet(s) should be labeled “Replacement Sheet” in the page header (as per 37 CFR 1.84(c)) so as not to obstruct any portion of the drawing figures. If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
The drawings are objected to because they include informalities. Figures 1-6 do not include any text labels, which are required for understanding of the drawings as per 37 CFR 1.84(o). Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The disclosure is objected to because of the following informalities:
The specification does not include a background as described in MPEP § 608.01(c)(2). If the description of related art was intentionally omitted, Applicant is requested to make a statement on the record confirming this omission.
Appropriate correction is required. The lengthy specification has not been checked to the extent necessary to determine the presence of all possible minor errors. Applicant’s cooperation is requested in correcting any errors of which applicant may become aware in the specification.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to abstract ideas without significantly more.
Independent Claim 10 recites a method that includes monitoring a network for configuration changes and detecting a change, updating a fetch job parameter, generating and storing a fetch job, executing the fetch job to retrieve security information, enriching the retrieved security information, and generating an output configured to enhance security. The generation of the fetch job and the enriching the information are mental processes because they only require compilation or manipulation of data. Mental processes are one of the groupings of abstract ideas set forth in MPEP § 2106.04(a)(2). Abstract ideas are judicial exceptions as per MPEP § 2106.04(I). See also Alice Corporation Pty. Ltd. v. CLS Bank, International, et al, 573 U.S. 208, 110 USPQ2d 1976 (2014).
The judicial exception is not integrated into a practical application because there is no positively recited use or further action with respect to the enrichment. Nothing is done with the enriched security information. The step of generating an output is extremely broadly and generically recited and it is not clear what this output actually includes. Although the claim recites an intended use of enhancing security, this is not a positive step of how the output would actually enhance security. The generation of the output does not even use the enriched security information. The output merely constitutes insignificant post-solution activity as per MPEP § 2106.05(g). The steps of monitoring and detecting, as well as executing the fetch job to retrieve information, each amount to mere data gathering, which is insignificant extra-solution activity as per MPEP § 2106.05(g). Similarly, at the high level recited, storing the fetch job in the queue is also insignificant extra-solution activity as per MPEP § 2106.05(g). There is nothing in the claim that would result in a particular transformation, as per MPEP § 2106.05(c), nor does the claim require the use of the abstract idea in conjunction with a particular machine or manufacture, as per MPEP § 2106.05(b). The source of the configuration changes being from a network merely describes the source of abstract data that is still manipulated in an abstract manner or a description of a particular technological environment, as per MPEP § 2106.05(h). The recitations of the steps being performed by a processor and memory do not constitute anything more than mere instructions to implement the abstract idea on a computer or a limitation to a particular technological environment, as per MPEP § 2106.05(f) and (h). There are no additional elements that apply or use the abstract idea in a meaningful way beyond merely linking the use of the judicial exception to a particular technological environment. There is no further step taken beyond generating the output that would result in a practical application of the abstract ideas. Therefore, the claim is not directed to a practical application of the abstract idea.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception for similar reasons as detailed above with respect to the question of a practical application of the judicial exception. The steps of detecting the configuration change, storing the fetch job retrieving security information, and generating output are claimed at a high level of generality and are generally directed to transmitting or receiving data over a network, or reading or writing data to or from memory. These have been recognized by the courts as well-understood, routine, and conventional functions. See MPEP § 2106.05(d)(II), citing Symantec, TLI, OIP Techs, buySAFE, and Versata. Therefore, the claim as a whole, whether the functions are considered individually or as an ordered combination, is not directed to significantly more than the abstract idea.
Dependent Claims 11-15 only recite further details of the abstract idea, such as further detail of the data that is compared, or further generic steps such as additional generic transmission of data. These claims recite abstract ideas for the same reasons as the independent claim, and also are not directed to a practical application and do not add significantly more to the abstract idea recited in the independent claim.
Independent Claim 1 is directed to a server having functionality corresponding to the method of Claim 10, and recites abstract ideas for similar reasons as Claim 10. The server does not integrate the abstract ideas into a practical application for similar reasons as detailed above. The recitation of the SIEM provider server, network, and processor and memory are at a high level and similarly constitute nothing more than mere instructions to implement the abstract idea on a computer or a limitation to a particular technological environment, as per MPEP § 2106.05(f) and (h). Therefore, Claim 1 is also not directed to significantly more than the abstract ideas.
Similarly, Independent Claim 16 is directed to a system having functionality corresponding to the method of Claim 10, and recites abstract ideas for similar reasons as Claim 10. The system does not integrate the abstract ideas into a practical application for similar reasons as detailed above. The recitation of the networks, SIEM provider server, and processor and memory are at a high level and similarly constitute nothing more than mere instructions to implement the abstract idea on a computer or a limitation to a particular technological environment, as per MPEP § 2106.05(f) and (h). Therefore, Claim 16 is also not directed to significantly more than the abstract ideas.
Dependent Claims 2-9 and 17-20 similarly only recite further details of the abstract idea, such as further detail of the data that is compared, or further generic steps such as additional generic transmission of data. These claims recite abstract ideas for the same reasons as the independent claim, and also are not directed to a practical application and do not add significantly more to the abstract idea recited in the independent claim.
Based upon consideration of all of the relevant factors with respect to the claims as an ordered combination and as a whole, Claims 1-20 are determined to be directed to abstract ideas without a practical application and without significantly more, as detailed above. Therefore, based on the above analysis, the claimed inventions are not directed to patent eligible subject matter.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites “update… a fetch job parameter stored in a job database based on the detected configuration change” in lines 9-10. It is not grammatically clear what the phrase “based on the detected configuration change” is intended to modify; from the placement, it appears that it would modify “stored in a job database”. The claim further recites “generate… an output” in line 16. It is not clear what this is an output of or how the output is generated. The above ambiguities render the claim indefinite.
Claim 3 recites “configured to disposition” in line 2. It is not clear what is meant by the verb “disposition” or if this may be intended to read “dispose”, for example. The claim further recites “wherein, when executed by the processor, the job manager and the workflow engine that, further cause the processor to transmit…” in lines 3-4. This is grammatically unclear, especially with respect to “that, further” which appears to be missing critical language, or alternately, “that” should be deleted.
Claim 4 recites “the output” in line 1; however, Claim 3 recited plural outputs, and it is not clear to which of the plural outputs this is intended to refer.
Claim 8 recites “an applicable automation playbook” in lines 2-3. The term “applicable” is a relative or subjective term, and the claims and specification do not clearly define how to determine whether a playbook is applicable. See also MPEP § 2173.05(b).
Claim 9 recites “further comprising transforming…” in line 1. It is not clear how the system would comprise a step of transforming, although it appears that this may be intended to recite that the processor is caused to transform the information.
Claim 10 recites “updating… a fetch job parameter stored in a job database based on the detected configuration change” in lines 9-10. It is not grammatically clear what the phrase “based on the detected configuration change” is intended to modify; from the placement, it appears that it would modify “stored in a job database”. The claim further recites “store the generated fetch job” in line 12. The tense of the verb “store” is not clear and is not in clear parallel structure with the other steps of the method. The claim additionally recites “generating… an output” in line 16. It is not clear what this is an output of or how the output is generated. The above ambiguities render the claim indefinite.
Claim 13 recites “an applicable automation playbook” in line 2. The term “applicable” is a relative or subjective term, and the claims and specification do not clearly define how to determine whether a playbook is applicable. See also MPEP § 2173.05(b).
Claim 14 recites “for dispositioning” in line 2. It is not clear what is meant by the verb “dispositioning” or if this may be intended to read “disposing”, for example.
Claim 15 recites “the output” in line 1; however, Claim 14 recited plural outputs, and it is not clear to which of the plural outputs this is intended to refer.
Claim 16 recites “update a fetch job parameter stored in a job database based on the detected configuration change” in lines 10-11. It is not grammatically clear what the phrase “based on the detected configuration change” is intended to modify; from the placement, it appears that it would modify “stored in a job database”. The claim further recites “generate an output” in line 17. It is not clear what this is an output of or how the output is generated. The above ambiguities render the claim indefinite.
Claim 17 recites “configured to disposition” in line 2. It is not clear what is meant by the verb “disposition” or if this may be intended to read “dispose”, for example. The claim further recites “wherein, when executed by the processor, the job manager and the workflow engine that, further cause the processor to transmit…” in lines 3-4. This is grammatically unclear, especially with respect to “that, further” which appears to be missing critical language.
Claim 18 recites “the output” in line 1; however, Claim 17 recited plural outputs, and it is not clear to which of the plural outputs this is intended to refer.
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-20 are rejected under 35 U.S.C. 102(a)(1) and (2) as being anticipated by Catakli et al, US Patent 11061548.
In reference to Claim 1, Catakli discloses a server that ingests and enriches security information associated with a network (column 188, lines 21-38, tenant network, SIEM system; column 21, lines 1-17, enriching data), where the server includes a processor and memory storing a job manager and workflow engine configured to periodically monitor the tenant network for configuration changes and detect a configuration change in the network (column 92, line 60-column 93, line 24, detecting changes; see also column 96, lines 14-63, user and application monitoring); update a fetch job parameter based on the detected change (column 95, line 26-column 96, line 13, query execution, and column 93, line 48-column 95, line 25, query parsing); generate, store, and execute a fetch job based on the updated parameter to retrieve security information from a data source (column 95, line 26-column 96, line 13, query execution); and enriching the retrieved security information and generating an output to enhance security of the network (column 21, lines 1-17, and column 202, line 58-column 203, line 3, enriching data).
In reference to Claim 2, Catakli further discloses a plurality of networks being monitored simultaneously (column 96, lines 14-63, monitoring).
In reference to Claims 3 and 4, Catakli further discloses a security management system providing disposition of outputs from the server and autonomously removing a suspect account (see column 191, line 64-column 192, line 26, removing threats).
In reference to Claim 5, Catakli further discloses a plurality of modules including an enrichment module, indicator of compromise extraction module, normalization module, and automation modules (column 186, line 49-column 187, line 9, various software modules).
In reference to Claims 6 and 7, Catakli further discloses detecting a type of security information such as an alert, where the enrichment is based on the detected type (column 161, line 50-column 162, line 4, alerts).
In reference to Claim 8, Catakli further discloses identifying an applicable automation playbook based on the detected type of information and using the playbook (column 193, line 63-column 198, line 7, detailing playbooks and their use).
In reference to Claim 9, Catakli further discloses transforming retrieved information into a standard format (see column 166, line 59-column 167, line 16, generating information in the same format).
Claims 10-15 are directed to methods corresponding substantially to the functionality of the server of Claims 1, 5, 6, 8, 3, and 4, respectively, and are rejected by a similar rationale.
Claims 16-20 are directed to systems including tenant networks and servers corresponding to those of Claims 1, 3-5, and 7, respectively, where the tenant networks were previously recited in Claim 2, and are rejected by a similar rationale, mutatis mutandis.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
McKinnon et al, US Patent 8881129, discloses a system for detecting changes in a multi-tenant system.
Dojka et al, US Patent 11553036, discloses a system for security monitoring using SIEMs and data enrichment.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zachary A Davis whose telephone number is (571)272-3870. The examiner can normally be reached Monday-Friday, 9:00am-5:30pm, Eastern Time.
Examiner interviews are available via telephone and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal D Dharia can be reached at (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Zachary A. Davis/Primary Examiner, Art Unit 2492
Prosecution Insights