DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-10, 12-16, and 18-22 are pending for examination. Claims 11 and 17 are cancelled in claim amendments filed 08/19/2026. Claims 21 and 22 are new.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-10, 12-16, and 18-22 are rejected under 35 U.S.C. 101 because the claimed invention is directed to (an) abstract idea(s) without significantly more.
Claims 1 and 15 recite:
receiving…a plurality of incident data collected from a detection and monitoring platform during execution of one or more workloads on a plurality of system components, the plurality of incident data including log data that includes telemetry data for a plurality of transactions between the plurality of system components;
identifying…one or more anomalies associated with one or more incident data among the plurality of incident data, wherein identifying the one or more anomalies comprises:
assigning transaction identifiers to the plurality of transactions based on the telemetry data, the telemetry data comprising at least one of operation identifier data, operation parent identifier data, or custom-dimension data;
combining transactions that share a common transaction identifier;
generating a plurality of transaction patterns representing sequences of interactions among the plurality of system components, the plurality of transaction patterns being generated from the combined transactions and uncombined transactions; and
identifying, as the one or more anomalies, one or more abnormal transaction patterns among the plurality of transaction patterns;
identifying…which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred;
mapping…each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component of the plurality of system components;
causing…a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred, and based on the mapping of the one or more anomalies;
repeating the following operations for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge: identifying, by the anomaly detection system, one or more additional anomalies based on the potential root cause initially identified by the plurality of diagnostics systems or based on potential root causes identified in a preceding iteration;
identifying, by the correlation system, which of the one or more additional anomalies are correlated with respect to the time at which the incident occurred; and
causing, by the troubleshooting system, the plurality of diagnostics systems to identify additional potential root causes for the incident, based at least on the one or more additional anomalies that are identified to correlate with the time at which the incident occurred;
generating…a first prompt based on the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the one or more incident data, and the identified potential root cause for the incident;
sending…the first prompt as input into a large language model ("LLM") -based system to output a summary of results that consolidates information regarding the incident, one or more possible explanations for occurrence of the incident, supporting information for the one or more possible explanations based on the identified potential root cause for the incident, and potential steps to resolve the incident; and
presenting…the summary of results.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes:
Claim 1 is a machine.
Claim 15 is a process.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying / …causing…to identify…’ limitations in # 2, 6, 7, and 9-12 above, as claimed and under broadest reasonable interpretation (BRI), are mental processes that cover performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses a person making an observation and/or an evaluation associated with data.
The ‘assigning’ limitation in # 3 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘combining’ limitation in # 4 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “combining” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘generating’ limitation in # 5 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “generating” in the context of this claim encompasses the person making an evaluation associated with data and mentally deriving simple sequences that can be either recorded via pen and paper or via a generic display.
The ‘mapping’ limitation in # 8 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “mapping” in the context of this claim encompasses the person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘receiving’ limitation in # 1 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “receiving” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
The ‘generating’ limitation in # 13 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘sending…to output’ limitation in # 14 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting a data string. See MPEP 2106.05(g).
The ‘presenting’ limitation in # 15 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “presenting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
an automated incident investigation system (Claims 1 and 15),
an investigation orchestration system (Claim 1),
an incident data collection system (Claims 1 and 15),
a diagnostics triggering system (Claim 1),
an anomaly detection system (Claims 1 and 15),
a correlation system (Claims 1 and 15),
a mapping system (Claims 1 and 15),
a troubleshooting system (Claims 1 and 15),
a results consolidation system (Claim 1),
a platform consolidation system (Claim 1), and
a summary system (Claims 1 and 15).
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 1 and 13-15 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 2 recites:
wherein the plurality of incident data further includes at least one of alert data, change data, metrics data, or system health data collected during execution of the one or more workloads,
wherein the anomaly detection system includes a corresponding at least one of an alert anomaly detection subsystem, a change anomaly detection subsystem, a metrics anomaly detection subsystem, a log anomaly detection subsystem, or a system health anomaly detection subsystem,
wherein identifying the one or more anomalies associated with the one or more incident data comprises identifying at least one of one or more alert anomalies associated with the alert data, one or more change anomalies associated with the change data, one or more metrics anomalies associated with the metrics data, one or more log anomalies associated with the log data, or one or more system health anomalies associated with the system health data, using the corresponding at least one of the alert anomaly detection subsystem, the change anomaly detection subsystem, the metrics anomaly detection subsystem, the log anomaly detection subsystem, or the system health anomaly detection subsystem.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying’ limitation in # 18 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an observation and/or an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 16 above, the claimed plurality of incident data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 17 above, the claimed anomaly detection system is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claims 3 and 21 recite:
wherein the one or more workloads includes one of a compute workload, a virtual machine ("VM") workload, a container orchestration environment workload, a software application workload, an artificial intelligence (“AI”) workload, a machine learning ("ML") workload, a system operation workload, a memory access and operation workload, a database access and operation workload, a data transfer workload, or a service bus workload.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes:
Claims 3 and 21 are machines.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claims 2 and 16, respectively, are the same as the abstract idea(s) of dependent Claims 3 and 21.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 19 above, the claimed workload is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claims 4 and 22 recite:
wherein the alert data corresponds to data that is collected by the detection and monitoring platform when a parameter value being monitored exceeds one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the parameter value, or a deviation from an observed pattern,
wherein the parameter value corresponds to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes:
Claims 4 and 22 are machines.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claims 2 and 16, respectively, are the same as the abstract idea(s) of dependent Claims 4 and 22.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 20 above, the claimed alert data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 21 above, the claimed parameter value is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 5 recites:
wherein the change data corresponds to data that is collected by the detection and monitoring platform when an incident occurs within a threshold period following one of a configuration change, a certificate change, a permissions change, a pathname change, an identifier ("ID") change, a location change, a patch installation, a hardware update, a firmware update, or a software update for a corresponding one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 5.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 22 above, the claimed change data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 6 recites:
wherein the metrics data corresponds to data that is collected by the detection and monitoring platform when time-series metrics values being monitored exceed one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the time-series metrics values, a sudden spike in observed metrics values, a sudden drop in observed metrics values, or a deviation from an observed pattern in the time-series metrics values,
wherein the time-series metrics values correspond to metrics related to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 6.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 23 above, the claimed metrics data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 24 above, the claimed time-series metrics values are further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 7 recites:
wherein the log data corresponds to data that is collected by the detection and monitoring platform when a new pattern in a log for one of a compute resource, a memory resource, a storage resource, a network resource, a virtual machine (“VM”), an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component is observed, and
a sentiment analysis on the new pattern indicates a potential issue with the new pattern.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘analysis’ limitation in # 26 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses the person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 25 above, the claimed log data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 8 recites:
wherein the system health data corresponds to data that is collected by the detection and monitoring platform when a health signal value being monitored for one of a compute resource, a memory resource, a storage resource, a network resource, a virtual machine (“VM”), an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component either falls below a threshold health level or deviates from a determined normal range of operating parameter values.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 8.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 27 above, the claimed system health data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 9 recites:
wherein the detection and monitoring platform includes at least one of alert monitoring systems, service level indicator or service level objective monitoring systems, system health monitoring systems, an artificial intelligence (“AI”)-based interactive assistant system, a resource monitoring system, an applications monitoring system, or an input system for manual triggering of incident investigation.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 9.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 28 above, the claimed detection and monitoring platform is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 10 recites:
wherein the diagnostics triggering system further includes a mapping system, wherein the first operations further comprise:
wherein the at least one system component includes at least one of a compute resource, a memory resource, a storage resource, a network resource, a virtual machine (“VM”), an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 10.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 29 above, the claimed at least one system component is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 12 recites:
wherein the platform consolidation system further comprises an anomaly enrichment system,
wherein the anomaly enrichment system compiles enrichment data associated with at least one of a period during which the incident occurred, a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred,
wherein the first prompt is further based on the enrichment data compiled by the anomaly enrichment system.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 12.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘compiles’ limitation in # 30 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “compiling” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
In # 31 above, the claimed first prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Additionally, the claim recites the following additional element:
an anomaly enrichment system.
This additional element is recited at a high level of generality (i.e. as a generic computer component) such that it amounts to no more than a component comprising mere instructions to apply an exception. Accordingly, this additional element does not integrate the abstract idea(s) into a practical application because it does not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional element amounts to no more than a component comprising mere instructions to apply an exception. Mere instructions to apply an exception using one or more generic computer components cannot provide an inventive concept.
Additionally, with regards to # 30 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015); OIP Techs., 788 F.3d at 1363, 115 USPQ2d at 1092-93.
Claim 13 recites:
wherein the platform consolidation system further comprises a group ranking system,
wherein the potential root cause for the incident includes multiple potential root causes,
wherein the group ranking system performs analysis on the multiple potential root causes and
assigns rankings to the multiple potential root causes,
wherein the first prompt is further based on the rankings of the multiple potential root causes.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘performs analysis’ limitation in # 33 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses a person making an evaluation associated with data.
The ‘assigns’ limitation in # 34 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses a person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 32 above, the claimed potential root cause is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 35 above, the claimed first prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 14 recites:
generating a second prompt based on the potential steps to resolve the incident,
sending the second prompt as input into the LLM-based system to output first instructions for an automated anomaly resolution system to implement a resolution process, and
sending the first instructions to the automated anomaly resolution system;
generating a third prompt based on the potential steps to resolve the incident,
sending the third prompt as input into the LLM-based system to output second instructions for one or more systems affected by the incident to implement a resolution process, and
sending the second instructions to the one or more systems; or
generating a fourth prompt based on the potential steps to resolve the incident,
sending the fourth prompt as input into the LLM-based system to output a service request for a service team to diagnose and resolve the incident, and
sending the service request to a service request intake system for the service team.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 14.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘generating’ limitations in # 36, 39, and 42 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘sending…to output’ limitations in # 37, 40, and 43 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
The ‘sending’ limitations in # 38, 41, and 44 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “sending” in the context of this claim encompasses mere data manipulation (sending/transmitting data). See MPEP 2106.05(g).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
With regards to # 36-44 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 16 recites:
receiving…a plurality of incident data including at least one of alert data, change data, metrics data, log data, or system health data collected from a detection and monitoring platform during execution of one or more workloads on a plurality of system components, the plurality of incident data including log data that includes telemetry data for a plurality of transactions between the plurality of system components;
identifying…one or more anomalies associated with the at least one of the alert data, change data, metrics data, log data, or system health data, wherein identifying the one or more anomalies comprises:
assigning transaction identifiers to the plurality of transactions based on the telemetry data, the telemetry data comprising at least one of operation identifier data, operation parent identifier data, or custom-dimension data;
combining transactions that share a common transaction identifier;
generating a plurality of transaction patterns representing sequences of interactions among the plurality of system components, the plurality of transaction patterns being generated from the combined transactions and uncombined transactions; and
identifying, as the one or more anomalies, one or more abnormal transaction patterns among the plurality of transaction patterns;
identifying…which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred;
mapping…each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component;
causing…a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred; and
iterating identification of anomalies correlated with respect to the time at which the incident occurred, mapping of correlated anomalies with system components, and causing the plurality of diagnostics systems to identify potential root causes for the incident for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge;
wherein the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the at least one of the alert data, change data, metrics data, log data, or system health data, the at least one system component mapped with the one or more anomalies correlated with the time at which the incident occurred, and the identified potential root cause for the incident are used to generate a prompt for a large language model ("LLM") -based system
to output a summary of results that consolidates information regarding the incident, one or more possible explanations for occurrence of the incident, supporting information for the one or more possible explanations based on the identified potential root cause for the incident, and potential steps to resolve the incident.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying / …causing…to identify…’ limitations in # 46, 50, 51, 53, and 54 above, as claimed and under BRI, are mental processes that cover performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses a person making an observation and/or an evaluation associated with data.
The ‘assigning’ limitation in # 47 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘combining’ limitation in # 48 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “combining” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘generating’ limitation in # 49 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “generating” in the context of this claim encompasses the person making an evaluation associated with data and mentally deriving simple sequences that can be either recorded via pen and paper or via a generic display.
The ‘mapping’ limitation in # 52 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “mapping” in the context of this claim encompasses the person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘receiving’ limitation in # 45 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “receiving” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
The ‘…to generate’ limitation in # 55 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘…to output’ limitation in # 56 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
an investigation orchestration system,
an incident data collection system,
a diagnostics triggering system,
an anomaly detection system,
a correlation system,
a mapping system, and
a troubleshooting system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 45, 55, and 56 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 18 merely further describes the claimed at least one system component of Claim 16 in the context of a mere field of use. See MPEP 2106.05(h).
Claim 19 recites:
a results consolidation system, comprising:
a platform consolidation system including a summary system;
wherein the results consolidation system executes computer executable instructions that cause the results consolidation system to perform second operations comprising:
generating, using the summary system, the prompt for the LLM-based system; and
presenting the summary of results.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 16 are the same as the abstract idea(s) of dependent Claim 19.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘generating’ limitation in # 57 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘presenting’ limitation in # 58 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “presenting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
a results consolidation system,
a platform consolidation system, and
a summary system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 57 and 58 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 20 recites:
wherein the platform consolidation system further comprises an anomaly enrichment system and a group ranking system,
wherein the anomaly enrichment system compiles enrichment data associated with at least one of a period during which the incident occurred, a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred;
wherein the potential root cause for the incident includes multiple potential root causes,
wherein the group ranking system performs analysis on the multiple potential root causes and
assigns rankings to the multiple potential root causes;
wherein the prompt is further based on the enrichment data compiled by the anomaly enrichment system and based on the rankings of the multiple potential root causes.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes: a machine.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘performs analysis’ limitation in # 61 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses a person making an evaluation associated with data.
The ‘assigns’ limitation in # 62 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses a person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘compiles’ limitation in # 59 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “compiling” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
In # 60 above, the claimed potential root cause is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 63 above, the claimed prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Additionally, the claim recites the following additional elements:
an anomaly enrichment system, and
a group ranking system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 59 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015); OIP Techs., 788 F.3d at 1363, 115 USPQ2d at 1092-93.
Allowable Subject Matter
Claims 1-10, 12-16, and 18-22 would be allowable if rewritten or amended to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph, set forth in this Office action.
The following is a statement of reasons for the indication of allowable subject matter:
The elements of independent Claims 1, 15, and 16 were neither found through a search of the prior art nor considered obvious by the Examiner. In particular, the prior art of record does not teach or suggest, in combination with the remaining limitations and in the context of their claims as a whole:
Claim 1: “…repeating the following operations for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge: identifying, using the anomaly detection system, one or more additional anomalies based on the potential root cause initially identified by the plurality of diagnostics systems or based on potential root causes identified in a preceding iteration; identifying, using the correlation system, which of the one or more additional anomalies are correlated with respect to the time at which the incident occurred; and causing, using the troubleshooting system, the plurality of diagnostics systems to identify additional potential root causes for the incident, based at least on the one or more additional anomalies that are identified to correlate with the time at which the incident occurred;…”
Claim 15: “…repeating the following operations for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge: identifying, by the anomaly detection system, one or more additional anomalies based on the potential root cause initially identified by the plurality of diagnostics systems or based on potential root causes identified in a preceding iteration; identifying, by the correlation system, which of the one or more additional anomalies are correlated with respect to the time at which the incident occurred; and causing, by the troubleshooting system, the plurality of diagnostics systems to identify additional potential root causes for the incident, based at least on the one or more additional anomalies that are identified to correlate with the time at which the incident occurred;…”
Claim 16: “…iterating identification of anomalies correlated with respect to the time at which the incident occurred, mapping of correlated anomalies with system components, and causing the plurality of diagnostics systems to identify potential root causes for the incident for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge;…”
Response to Arguments
Applicant's arguments filed 08/19/2026, with regards to 35 U.S.C. 101, have been fully considered, but they are not persuasive.
The Remarks argue that [t]hese amended limitations do not merely recite observing information, evaluating information, and reaching a conclusion. Rather, the amended claims recite a specific telemetry-processing workflow in which telemetry data collected during execution of workloads is used to construct transaction patterns representing interactions among system components and to identify abnormal transaction patterns among the constructed transaction patterns. The claimed anomalies are therefore identified using processor-implemented construction and analysis of interactions among computing system components, rather than from mental observation or evaluation of information. Accordingly, the amended claims recite significantly more than a mental process and cannot reasonably be characterized as mere mental steps performed in the human mind.
However, the Examiner respectfully disagrees.
The amended claim language (using Claim 1 as representative) is listed below:
…receiving…a plurality of incident data collected from a detection and monitoring platform during execution of one or more workloads on a plurality of system components, the plurality of incident data including log data that includes telemetry data for a plurality of transactions between the plurality of system components;…
The Examiner respectfully asserts that this limitation, under BRI, is still merely receiving data (data gathering). How (during execution of one or more workloads) is irrelevant; the data can still be received generically. For example, workloads can be executed, resulting in data being printed out and/or displayed generically, and then given to a person (received).
More of the amended claim language (using Claim 1 as representative) is listed below:
…wherein identifying the one or more anomalies comprises: assigning transaction identifiers to the plurality of transactions based on the telemetry data, the telemetry data comprising at least one of operation identifier data, operation parent identifier data, or custom-dimension data;
combining transactions that share a common transaction identifier;
generating a plurality of transaction patterns representing sequences of interactions among the plurality of system components, the plurality of transaction patterns being generated from the combined transactions and uncombined transactions; and
identifying, as the one or more anomalies, one or more abnormal transaction patterns among the plurality of transaction patterns;…
As to Applicant’s “[t]he claimed anomalies are therefore identified using processor-implemented construction and analysis of interactions among computing system components, rather than from mental observation or evaluation of information.” , the Examiner respectfully asserts that these four steps are still mental process steps when considering simple data identification/evaluation, simple combinations, and simple pattern generations.
The Examiner refers to MPEP 2106.04(a)(2)(III)(C): A Claim That Requires a Computer May Still Recite a Mental Process. “Processor-implemented construction” and “analysis among computing system components” certainly indicate performing mental processes on a generic computer, in a computing environment, and/or using a computer as a tool.
For at least the reasoning provided above, Claims 1-10, 12-16, and 18-22 remain rejected.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSEPH KUDIRKA whose telephone number is (571)270-7126. The examiner can normally be reached M-F 7:30am - 5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ashish Thomas can be reached at (571) 272-0631. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOSEPH R KUDIRKA/Primary Patent Examiner, Art Unit 2114
Prosecution Insights