DETAILED ACTION
This first non-final action is in response to applicants’ continuation filed on 06/25/2025. Claims 46-69 are currently pending and have been considered as follows.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Drawings
The drawings filed on 06/25/2025 are accepted.
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 10/20/2025, 01/08/2026, 04/07/2026, 04/30/2026, 05/29/2026, 07/31/2026, and 08/20/2026 have been placed in the application file, and the information referred therein has been considered as to the merits.
Claim Objections
Claims 49, 57, and 65 are objected to because of the following informalities:
Claim 49 is missing a period “.” at the end of the claim;
Claim 57 is missing a period “.” at the end of the claim;
Claim 65 is missing a period “.” at the end of the claim;
Appropriate correction is required.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
U.S. Patent No. 11,108,798 B2
Claims 46-69 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1-18 of parent U.S. Patent No. 11,108,798 B2 (common inventive entity and assignee) in view of the prior art Futoransky et al. (US 20030220940 A1, hereinafter Futoransky). Although the claims at issue are not identical, they are not patentably distinct from each other because the examined application Claims 46-69 are an obvious variation of Claims 1-18 of the parent patent in view of the prior art reference Futoransky. All the elements of Claims 46-69 of the instant application are found within the scope of Claims 1-18 of parent U.S. Patent No. 11,108,798 B2 except for the feature of “logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform”.
However, the analogous prior art Futoransky does disclose logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Futoransky “Generally these events are generated by the auditing subsystems of such IT assets and collected in system logs stored either locally… Events specifically related to information security are stored in these system logs” [0008]; “monitor information technology assets and report on the status of their security, generating and maintaining their own security logs with relevant information security events” [0009]; “may have an auditing subsystem configured to collect and store auditable events in a system or security log” [0030]; [0031]; [0032]; [0034]).
It would have been an obvious modification to Claims 1-18 of U.S. Patent No. 11,108,798 B2 to include “logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform” (as taught by Futoransky) for the purpose of troubleshooting and security auditing (Futoransky [0032]; [0034]).
Therefore, the invention as specified in the instant application Claims 46-69 is not patentably distinct from Claims 1-18 of parent U.S. Patent No. 11,108,798 B2 in view of the prior art Futoransky.
U.S. Patent No. 11,297,080 B2
Claims 46-69 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1-15 of commonly owned U.S. Patent No. 11,297,080 B2 (common inventive entity and assignee). Although the conflicting claims are not identical, they are not patentably distinct from each other because it is clear that all the elements of the instant application claims 46-69 are to be found in the patent claims 1-15. The difference between the application claims and the patent claims lies in the fact that the patent claims include more elements and are more specific. Thus, the invention of claims 1-15 of the patent is in effect a “species” of the “generic” invention of the instant application claims 46-69. It has been held that the generic invention is “anticipated” by the “species”. See In re Goodman, 29 USPQ2d 2010 (Fed. Cir. 1993). The following Claims Comparison Table illustrates the anticipatory relationship of the claims at issue.
Claims Comparison Table
Instant Application:
19/248,807
U.S. Patent No. 11,297,080 B2
(common inventive entity and assignee)
Claim 46:
A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 1:
A computer-implemented method, executed on a computing device, comprising:
obtaining consolidated platform information for a computing platform from a Security Information and Event Management (SIEM) system to identify a plurality of deployed security-relevant subsystems, including monitoring and logging activity of the plurality of deployed security-relevant subsystems by the SIEM system;
establishing connectivity with the plurality of deployed security-relevant subsystems within the computing platform based upon the identifying the plurality of deployed security-relevant subsystems, including utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems, the plurality of deployed security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query from a third party;
distributing at least a portion of the unified query to the plurality of deployed security-relevant subsystems;
effectuating at least a portion of the unified query on each of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of deployed security-relevant subsystems, thus defining a plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform, including:
one or more of iteratively and continuously modifying and revising a probabilistic model;
identifying one or more commonalities amongst the plurality of security-relevant information sets using the probabilistic model; and
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set based on the identified commonalities;
enabling the third-party access to the aggregated security-relevant information set including initial security-relevant information;
allowing the third party to manipulate the initial security-relevant information with automation information including:
allowing the third party to select automation information to add to the initial security-relevant information, including allowing the third party to select a specific type of automation information from a plurality of automation information types to add to the initial security-relevant; and
generating revised security-relevant information based upon, at least in part, the initial security-relevant information and the automation information.
Claim 47:
The computer-implemented method of claim 46 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 1:
… utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems,
Claim 48:
The computer-implemented method of claim 22 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 1:
… homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set
Claim 49:
The computer-implemented method of claim 46 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 1:
… enabling the third-party access to the aggregated security-relevant information set including initial security-relevant information;
Claim 50:
The computer-implemented method of claim 46 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 2:
The computer-implemented method of claim 1 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 51:
The computer-implemented method of claim 46 wherein the plurality of security- relevant information sets utilize a plurality of different formats.
Claim 3:
The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 52:
The computer-implemented method of claim 46 wherein the plurality of security- relevant information sets utilize a plurality of different nomenclatures.
Claim 4:
The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 53:
The computer-implemented method of claim 46 wherein the plurality of security- relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 5:
The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 54:
A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security- relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 6:
A computer program product comprising a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
obtaining consolidated platform information for a computing platform from a Security Information and Event Management (SIEM) system to identify a plurality of deployed security-relevant subsystems, including monitoring and logging activity of the plurality of deployed security-relevant subsystems by the SIEM system;
establishing connectivity with the plurality of deployed security-relevant subsystems within the computing platform based upon the identifying the plurality of deployed security-relevant subsystems, including utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems, the plurality of deployed security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query from a third party;
distributing at least a portion of the unified query to the plurality of deployed security-relevant subsystems;
effectuating at least a portion of the unified query on each of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of deployed security-relevant subsystems, thus defining a plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform, including: one or more of iteratively and continuously modifying and revising a probabilistic model;
identifying one or more commonalities amongst the plurality of security-relevant information sets using the probabilistic model; and homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set based on the identified commonalities;
enabling the third-party access to the aggregated security-relevant information set including initial security-relevant information;
allowing the third party to manipulate the initial security-relevant information with automation information including:
allowing the third party to select automation information to add to the initial security-relevant information, including allowing the third party to select a specific type of automation information from a plurality of automation information types to add to the initial security-relevant; and generating revised security-relevant information based upon, at least in part, the initial security-relevant information and the automation information.
Claim 55:
The computer program product of claim 54 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 6:
… utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems,
Claim 56:
The computer program product of claim 54 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 6:
… homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set
Claim 57:
The computer program product of claim 54, further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 6:
… enabling third-party access to the aggregated security-relevant information set
Claim 58:
The computer program product of claim 54 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 7:
The computer program product of claim 6 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 59:
The computer program product of claim 54 wherein the plurality of security- relevant information sets utilize a plurality of different formats.
Claim 8:
The computer program product of claim 6 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 60:
The computer program product of claim 54 wherein the plurality of security- relevant information sets utilize a plurality of different nomenclatures.
Claim 9:
The computer program product of claim 6 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 61:
The computer program product of claim 54 wherein the plurality of security- relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 10:
The computer program product of claim 6 wherein the plurality of deployed security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 62:
A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security- relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 11:
A computing system including a processor and memory configured to perform operations comprising:
obtaining consolidated platform information for a computing platform from a Security Information and Event Management (SIEM) system to identify a plurality of deployed security-relevant subsystems, including monitoring and logging activity of the plurality of deployed security-relevant subsystems by the SIEM system;
establishing connectivity with the plurality of deployed security-relevant subsystems within the computing platform based upon the identifying the plurality of deployed security-relevant subsystems, including utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems, the plurality of deployed security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems; receiving a unified query from a third party;
distributing at least a portion of the unified query to the plurality of deployed security-relevant subsystems;
effectuating at least a portion of the unified query on each of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of deployed security-relevant subsystems, thus defining a plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform, including:
one or more of iteratively and continuously modifying and revising a probabilistic model;
identifying one or more commonalities amongst the plurality of security-relevant information sets using the probabilistic model; and homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set based on the identified commonalities;
enabling the third-party access to the aggregated security-relevant information set including initial security-relevant information;
allowing the third party to manipulate the initial security-relevant information with automation information including: allowing the third party to select automation information to add to the initial security-relevant information, including allowing the third party to select a specific type of automation information from a plurality of automation information types to add to the initial security-relevant; and generating revised security-relevant information based upon, at least in part, the initial security-relevant information and the automation information.
Claim 63:
The computing system of claim 62 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 11:
… utilizing at least one application program interface to access at least one of the plurality of deployed security-relevant subsystems,
Claim 64:
The computing system of claim 62 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 11:
… homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set
Claim 65:
The computing system of claim 62 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 11:
… enabling third-party access to the aggregated security-relevant information set;
Claim 66:
The computing system of claim 62 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 12:
The computing system of claim 11 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 67:
The computing system of claim 62 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 13:
The computing system of claim 11 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 68:
The computing system of claim 62 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 14:
The computing system of claim 11 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 69:
The computing system of claim 62 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 15:
The computing system of claim 11 wherein the plurality of deployed security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
U.S. Patent No. 12,346,451 B2
Claims 46-69 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1-24 of commonly owned U.S. Patent No. 12,346,451 B2 (common inventive entity and assignee). Although the conflicting claims are not identical, they are not patentably distinct from each other because it is clear that all the elements of the instant application claims 46-69 are to be found in the patent claims 1-24. The difference between the application claims and the patent claims lies in the fact that the patent claims include more elements and are more specific. Thus, the invention of claims 1-24 of the patent is in effect a “species” of the “generic” invention of the instant application claims 46-69. It has been held that the generic invention is “anticipated” by the “species”. See In re Goodman, 29 USPQ2d 2010 (Fed. Cir. 1993). The following Claims Comparison Table illustrates the anticipatory relationship of the claims at issue.
Claims Comparison Table
Instant Application:
19/248,807
U.S. Patent No. 12,346,451 B2
(common inventive entity and assignee)
Claim 46:
A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 1:
A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event;
processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and
generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
Claim 47:
The computer-implemented method of claim 46 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 2:
The computer-implemented method of claim 1 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 48:
The computer-implemented method of claim 22 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 3:
The computer-implemented method of claim 1 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 49:
The computer-implemented method of claim 46 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 4:
The computer-implemented method of claim 1 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 50:
The computer-implemented method of claim 46 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 5:
The computer-implemented method of claim 1 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 51:
The computer-implemented method of claim 46 wherein the plurality of security- relevant information sets utilize a plurality of different formats.
Claim 6:
The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 52:
The computer-implemented method of claim 46 wherein the plurality of security- relevant information sets utilize a plurality of different nomenclatures.
Claim 7:
The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 53:
The computer-implemented method of claim 46 wherein the plurality of security- relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 8:
The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 54:
A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security- relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 9:
A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event;
processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and
generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
Claim 55:
The computer program product of claim 54 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 10:
The computer program product of claim 9 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 56:
The computer program product of claim 54 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 11:
The computer program product of claim 9 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 57:
The computer program product of claim 54, further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 12:
The computer program product of claim 9, further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 58:
The computer program product of claim 54 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 13:
The computer program product of claim 9 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 59:
The computer program product of claim 54 wherein the plurality of security- relevant information sets utilize a plurality of different formats.
Claim 14:
The computer program product of claim 9 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 60:
The computer program product of claim 54 wherein the plurality of security- relevant information sets utilize a plurality of different nomenclatures.
Claim 15:
The computer program product of claim 9 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 61:
The computer program product of claim 54 wherein the plurality of security- relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 16:
The computer program product of claim 9 wherein the plurality of deployed security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 62:
A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform;
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform.
Claim 17:
A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform;
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform, the plurality of security-relevant subsystems including one or more of Content Delivery Network systems, Database Activity Monitoring systems, User Behavior Analytic systems, Mobile Device Management systems, Identity and Access Management systems, Domain Name Server systems, antivirus systems, operating systems;
receiving a unified query, the unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries;
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems;
obtaining at least one security-relevant information set from each of the subset of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets, wherein the plurality of security-relevant information sets include one or more artifacts concerning a detected security event; processing the plurality of security-relevant information sets using artificial intelligence/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets;
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform;
obtaining artifact information concerning the one or more artifacts; and generating a conclusion concerning the detected security event based upon, at least in part, the detected security event, the one or more artifacts and the artifact information.
Claim 63:
The computing system of claim 62 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 18:
The computing system of claim 17 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.
Claim 64:
The computing system of claim 62 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 19:
The computing system of claim 17 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set includes: homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
Claim 65:
The computing system of claim 62 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 20:
The computing system of claim 17 further comprising: enabling third-party access to the aggregated security-relevant information set.
Claim 66:
The computing system of claim 62 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 21:
The computing system of claim 17 further comprising: enabling third-party searching of the aggregated security-relevant information set.
Claim 67:
The computing system of claim 62 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 22:
The computing system of claim 17 wherein the plurality of security-relevant information sets utilize a plurality of different formats.
Claim 68:
The computing system of claim 62 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 23:
The computing system of claim 17 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
Claim 69:
The computing system of claim 62 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim 24:
The computing system of claim 17 wherein the plurality of deployed security-relevant subsystems includes one or more of: a data lake; a data log; a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 46, 47, 49, 51, 53-55, 57, 59, 61-63, 65, 67, and 69 are rejected under 35 U.S.C. 103 as being unpatentable over Navas (US 20100125574 A1) in view of Futoransky et al. (US 20030220940 A1, hereinafter Futoransky.
As to Claim 46:
Navas discloses a computer-implemented method (e.g. Navas Fig. 7 method/process), executed on a computing device (e.g. Navas “FIG. 11 is a block diagram of a computing system on which embodiments of the invention can be implemented. Computing system 1100 represents hardware” [0126]), comprising:
monitoring by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Navas “However, some queries may be "standing queries" that represent monitoring of events within the enterprise” [0034]; “each data source 112, 122, 132, and 142 may represent one or more subsystems that generate event data. The data sources at a single node need not be of the same type. Thus, for example, any number of different systems could each produce event data, such as an ERP system, a database interface system, a CRM system, etc., as well as providing real-time or non real-time data. Thus, each data source could be one or more of a CRM system, an ERP system, a database, a flat file, etc. The CRM and ERP systems may generate real-time data, while databases and flat files represent examples of historical data warehouses. In one embodiment, the event producer represented by the data sources publishes or makes available all event data” [0032]; see also “the LE system can monitor the event data, and detect when a particular event or series of events or conditions takes place. When detected, the LE system can clip and push the information to the user who queried for the particular event, series of events, or conditions” [0045]; see also “FIGS. 5A-5C are block diagrams of embodiments of a event pattern monitoring system” [0077]; see also “The event pattern query type may be considered a monitoring query, in that a "query" is generated, and the system "waits" for data that answers the query. Such a system may also be referred to as an exception-based system, waiting for a pattern to be matched (an exception), rather than being informed of every detail of the system's operation;” [0079]);
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform (e.g. Navas Fig. 4, connection with data source ERP 450 and CRM 460; [0072]. ERP 450 includes database for event data A and C);
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries (e.g. Navas Fig. 7, Enterprise Event Server Receives Event Query 708; “the event server parses the event query into component parts, 710. Parsing the query can be done with lookup tables or other tables or matching mechanisms” [0092], The event server identifies one or more data sources that have information relevant to the query, 712; “Parser 1172 enables eventing engine 1170 to parse queries into component parts. Index 1174 provides routing information for eventing engine to identify data sources. Router 1176 enables eventing engine 1170 to route the queries to the identified data sources, including determining a path in the network, and identifying other LE server nodes. Responder 1178 enables eventing engine 1170 to generate responses to the queries based on the response components received from the data sources” [0131]);
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems (e.g. Navas Fig. 7, Event Data Source Receives Query Component 718; “The eventing system will attempt to send the query as close to the data source(s) as possible for processing. The event server identifies one or more data sources that have information relevant to the query, 712. The event server determines how to route the query components to the data sources” [0092]; “the query is processed as close to the data source as possible to receive the most up-to-date information (real-time events)” [0093]);
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets (e.g. Navas “The data source returns a query response, 722. In the case where the query received is a query component, the response will be to the query component, which will provide only some of the information necessary to respond to the original user query. The event server combines a complete response from the separate query component responses received from all data sources, 724” [0094]; Navas Fig. 7, Event Data Source Returns (Component) Query Response 722); and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform (e.g. Navas “The event server combines a complete response from the separate query component responses received from all data sources, 724. Combining of a response may be to combine multiple component responses, each to a different query component segment, as well as combining multiple responses for the same query component segment received from multiple different data sources. Combining the response may require processing of the data. For example, overlapping data or conflicting data may be compared and eliminated” [0094]; Fig. 7, Event Server Combines Responses For Separate Query Component Responses 724);
But Navas does not specifically disclose:
logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform.
However, the analogous prior art Futoransky does disclose logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Futoransky “Generally these events are generated by the auditing subsystems of such IT assets and collected in system logs stored either locally… Events specifically related to information security are stored in these system logs” [0008]; “monitor information technology assets and report on the status of their security, generating and maintaining their own security logs with relevant information security events” [0009]; “may have an auditing subsystem configured to collect and store auditable events in a system or security log” [0030]; [0031]; [0032]; [0034]). Navas and Futoransky are analogous art because they are from the same field of endeavor in data reporting and response management.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas and Futoransky before him or her, to modify the disclosure of Navas with the teachings of Futoransky to include logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform as claimed because Navas teaches a method and system for querying data sources in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could include generating and maintaining security logs with relevant information security events (Futoransky [0008]; [0009]; [0030]; [0031]; [0032]; [0034]). The suggestion/motivation for doing so would have been for the purpose of troubleshooting and security auditing (Futoransky [0032]; [0034]). Therefore, it would have been obvious to combine Navas and Futoransky to obtain the invention as specified in the instant claim(s).
As to Claim 47:
Navas in view of Futoransky discloses the computer-implemented method of claim 46 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems (e.g. Navas “System 1000 may include multiple APIs (application programming interfaces) that enable a user to interact with LE server 1002. APIs 1018 represent such interfaces”; see Navas Fig. 4, user provides query to LE node to access ERP 450 and CRM 460” [0104]).
As to Claim 49:
Navas in view of Futoransky discloses the computer-implemented method of claim 46 further comprising: enabling third-party access to the aggregated security-relevant information set (e.g. Navas “The event server returns the response to the user, 726. The user system may receive an actionable, real-time event, 728. An actionable event may allow the user to access an enterprise backend for additional information, launch actions, initiate processes, or other procedures” [0094]; Fig. 7, User System Receives Actionable, Real-Time Event Data 728).
As to Claim 51:
Navas in view of Futoransky discloses the computer-implemented method of claim 46 wherein the plurality of security-relevant information sets utilize a plurality of different formats (e.g. Navas “event data produced by a data source may be of a format that is inconsistent with the system through which the query was generated, or incompatible with the format expected by the user… The LE nodes may also translate events to the format required by underlying systems where actions are to be performed” [0036]).
As to Claim 53:
Navas in view of Futoransky discloses the computer-implemented method of claim 46 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log (e.g. Navas “Each element of hardware and software within the enterprise system may be referred to as a subsystem, or simply "system" (thus, the enterprise system may be considered a system of systems). The enterprise system as described herein includes data sources. The data sources may be any subsystem (e.g., supply chain management (SCM), enterprise resource planning (ERP), human resources, customer relations management (CRM), information technology (IT), etc.), database, or other element within the enterprise that implements a change to one or more objects (e.g., structured objects, including business objects that generally are part of a business context such as a "Customer" object). Each change to an object may be referred to as an event” [0026]); a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
As to Claim 54:
Navas discloses a computer program product residing on a non-transitory computer readable medium (e.g. Navas memory storing code, instructions to be executed by processor [0127]; storage medium [0132]) having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Navas “However, some queries may be "standing queries" that represent monitoring of events within the enterprise” [0034]; “each data source 112, 122, 132, and 142 may represent one or more subsystems that generate event data. The data sources at a single node need not be of the same type. Thus, for example, any number of different systems could each produce event data, such as an ERP system, a database interface system, a CRM system, etc., as well as providing real-time or non real-time data. Thus, each data source could be one or more of a CRM system, an ERP system, a database, a flat file, etc. The CRM and ERP systems may generate real-time data, while databases and flat files represent examples of historical data warehouses. In one embodiment, the event producer represented by the data sources publishes or makes available all event data” [0032]; see also “the LE system can monitor the event data, and detect when a particular event or series of events or conditions takes place. When detected, the LE system can clip and push the information to the user who queried for the particular event, series of events, or conditions” [0045]; see also “FIGS. 5A-5C are block diagrams of embodiments of a event pattern monitoring system” [0077]; see also “The event pattern query type may be considered a monitoring query, in that a "query" is generated, and the system "waits" for data that answers the query. Such a system may also be referred to as an exception-based system, waiting for a pattern to be matched (an exception), rather than being informed of every detail of the system's operation;” [0079]);
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform (e.g. Navas Fig. 4, connection with data source ERP 450 and CRM 460; [0072]. ERP 450 includes database for event data A and C);
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries (e.g. Navas Fig. 7, Enterprise Event Server Receives Event Query 708; “the event server parses the event query into component parts, 710. Parsing the query can be done with lookup tables or other tables or matching mechanisms” [0092], The event server identifies one or more data sources that have information relevant to the query, 712; “Parser 1172 enables eventing engine 1170 to parse queries into component parts. Index 1174 provides routing information for eventing engine to identify data sources. Router 1176 enables eventing engine 1170 to route the queries to the identified data sources, including determining a path in the network, and identifying other LE server nodes. Responder 1178 enables eventing engine 1170 to generate responses to the queries based on the response components received from the data sources” [0131]);
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems (e.g. Navas Fig. 7, Event Data Source Receives Query Component 718; “The eventing system will attempt to send the query as close to the data source(s) as possible for processing. The event server identifies one or more data sources that have information relevant to the query, 712. The event server determines how to route the query components to the data sources” [0092]; “the query is processed as close to the data source as possible to receive the most up-to-date information (real-time events)” [0093]);
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets (e.g. Navas “The data source returns a query response, 722. In the case where the query received is a query component, the response will be to the query component, which will provide only some of the information necessary to respond to the original user query. The event server combines a complete response from the separate query component responses received from all data sources, 724” [0094]; Navas Fig. 7, Event Data Source Returns (Component) Query Response 722); and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform (e.g. Navas “The event server combines a complete response from the separate query component responses received from all data sources, 724. Combining of a response may be to combine multiple component responses, each to a different query component segment, as well as combining multiple responses for the same query component segment received from multiple different data sources. Combining the response may require processing of the data. For example, overlapping data or conflicting data may be compared and eliminated” [0094]; Fig. 7, Event Server Combines Responses For Separate Query Component Responses 724);
But Navas does not specifically disclose:
logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform.
However, the analogous prior art Futoransky does disclose logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Futoransky “Generally these events are generated by the auditing subsystems of such IT assets and collected in system logs stored either locally… Events specifically related to information security are stored in these system logs” [0008]; “monitor information technology assets and report on the status of their security, generating and maintaining their own security logs with relevant information security events” [0009]; “may have an auditing subsystem configured to collect and store auditable events in a system or security log” [0030]; [0031]; [0032]; [0034]). Navas and Futoransky are analogous art because they are from the same field of endeavor in data reporting and response management.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas and Futoransky before him or her, to modify the disclosure of Navas with the teachings of Futoransky to include logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform as claimed because Navas teaches a method and system for querying data sources in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could include generating and maintaining security logs with relevant information security events (Futoransky [0008]; [0009]; [0030]; [0031]; [0032]; [0034]). The suggestion/motivation for doing so would have been for the purpose of troubleshooting and security auditing (Futoransky [0032]; [0034]). Therefore, it would have been obvious to combine Navas and Futoransky to obtain the invention as specified in the instant claim(s).
As to Claim 55:
Navas in view of Futoransky discloses the computer program product of claim 54 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems (e.g. Navas “System 1000 may include multiple APIs (application programming interfaces) that enable a user to interact with LE server 1002. APIs 1018 represent such interfaces”; see Navas Fig. 4, user provides query to LE node to access ERP 450 and CRM 460” [0104]).
As to Claim 57:
Navas in view of Futoransky discloses the computer program product of claim 54 further comprising: enabling third-party access to the aggregated security-relevant information set (e.g. Navas “The event server returns the response to the user, 726. The user system may receive an actionable, real-time event, 728. An actionable event may allow the user to access an enterprise backend for additional information, launch actions, initiate processes, or other procedures” [0094]; Fig. 7, User System Receives Actionable, Real-Time Event Data 728).
As to Claim 59:
Navas in view of Futoransky discloses the computer program product of claim 54 wherein the plurality of security-relevant information sets utilize a plurality of different formats (e.g. Navas “event data produced by a data source may be of a format that is inconsistent with the system through which the query was generated, or incompatible with the format expected by the user” [0036]).
As to Claim 61:
Navas in view of Futoransky discloses the computer program product of claim 54 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log (e.g. Navas “Each element of hardware and software within the enterprise system may be referred to as a subsystem, or simply "system" (thus, the enterprise system may be considered a system of systems). The enterprise system as described herein includes data sources. The data sources may be any subsystem (e.g., supply chain management (SCM), enterprise resource planning (ERP), human resources, customer relations management (CRM), information technology (IT), etc.), database, or other element within the enterprise that implements a change to one or more objects (e.g., structured objects, including business objects that generally are part of a business context such as a "Customer" object). Each change to an object may be referred to as an event” [0026]); a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
As to Claim 62:
Navas discloses a computing system including a processor and memory (e.g. Navas “FIG. 11 is a block diagram of a computing system on which embodiments of the invention can be implemented. Computing system 1100 represents hardware… includes one or more processors” [0126]; memory storing instructions [0127]) configured to perform operations comprising:
monitoring by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Navas “However, some queries may be "standing queries" that represent monitoring of events within the enterprise” [0034]; “each data source 112, 122, 132, and 142 may represent one or more subsystems that generate event data. The data sources at a single node need not be of the same type. Thus, for example, any number of different systems could each produce event data, such as an ERP system, a database interface system, a CRM system, etc., as well as providing real-time or non real-time data. Thus, each data source could be one or more of a CRM system, an ERP system, a database, a flat file, etc. The CRM and ERP systems may generate real-time data, while databases and flat files represent examples of historical data warehouses. In one embodiment, the event producer represented by the data sources publishes or makes available all event data” [0032]; see also “the LE system can monitor the event data, and detect when a particular event or series of events or conditions takes place. When detected, the LE system can clip and push the information to the user who queried for the particular event, series of events, or conditions” [0045]; see also “FIGS. 5A-5C are block diagrams of embodiments of a event pattern monitoring system” [0077]; see also “The event pattern query type may be considered a monitoring query, in that a "query" is generated, and the system "waits" for data that answers the query. Such a system may also be referred to as an exception-based system, waiting for a pattern to be matched (an exception), rather than being informed of every detail of the system's operation;” [0079]);
establishing connectivity with the plurality of deployed security-relevant subsystems within a computing platform (e.g. Navas Fig. 4, connection with data source ERP 450 and CRM 460; [0072]; ERP 450 includes database for event data A and C);
receiving a unified query including a query that may be parsed to provide a plurality of security-relevant subsystem specific queries (e.g. Navas Fig. 7, Enterprise Event Server Receives Event Query 708; “the event server parses the event query into component parts, 710. Parsing the query can be done with lookup tables or other tables or matching mechanisms” [0092], The event server identifies one or more data sources that have information relevant to the query, 712; “Parser 1172 enables eventing engine 1170 to parse queries into component parts. Index 1174 provides routing information for eventing engine to identify data sources. Router 1176 enables eventing engine 1170 to route the queries to the identified data sources, including determining a path in the network, and identifying other LE server nodes. Responder 1178 enables eventing engine 1170 to generate responses to the queries based on the response components received from the data sources” [0131]);
effectuating at least a portion of the unified query on at least a subset of the plurality of deployed security-relevant subsystems (e.g. Navas Fig. 7, Event Data Source Receives Query Component 718; “The eventing system will attempt to send the query as close to the data source(s) as possible for processing. The event server identifies one or more data sources that have information relevant to the query, 712. The event server determines how to route the query components to the data sources” [0092]; “the query is processed as close to the data source as possible to receive the most up-to-date information (real-time events)” [0093]);
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets (e.g. Navas “The data source returns a query response, 722. In the case where the query received is a query component, the response will be to the query component, which will provide only some of the information necessary to respond to the original user query. The event server combines a complete response from the separate query component responses received from all data sources, 724” [0094]; Navas Fig. 7, Event Data Source Returns (Component) Query Response 722); and
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform (e.g. Navas “The event server combines a complete response from the separate query component responses received from all data sources, 724. Combining of a response may be to combine multiple component responses, each to a different query component segment, as well as combining multiple responses for the same query component segment received from multiple different data sources. Combining the response may require processing of the data. For example, overlapping data or conflicting data may be compared and eliminated” [0094]; Fig. 7, Event Server Combines Responses For Separate Query Component Responses 724);
But Navas does not specifically disclose:
logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform.
However, the analogous prior art Futoransky does disclose logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform (e.g. Futoransky “Generally these events are generated by the auditing subsystems of such IT assets and collected in system logs stored either locally… Events specifically related to information security are stored in these system logs” [0008]; “monitor information technology assets and report on the status of their security, generating and maintaining their own security logs with relevant information security events” [0009]; “may have an auditing subsystem configured to collect and store auditable events in a system or security log” [0030]; [0031]; [0032]; [0034]). Navas and Futoransky are analogous art because they are from the same field of endeavor in data reporting and response management.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas and Futoransky before him or her, to modify the disclosure of Navas with the teachings of Futoransky to include logging, by a plurality of deployed security-relevant subsystems, activity with respect to a computing platform as claimed because Navas teaches a method and system for querying data sources in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could include generating and maintaining security logs with relevant information security events (Futoransky [0008]; [0009]; [0030]; [0031]; [0032]; [0034]). The suggestion/motivation for doing so would have been for the purpose of troubleshooting and security auditing (Futoransky [0032]; [0034]). Therefore, it would have been obvious to combine Navas and Futoransky to obtain the invention as specified in the instant claim(s).
As to Claim 63:
Navas in view of Futoransky discloses the computing system of claim 62 wherein establishing connectivity with a plurality of security-relevant subsystems includes: utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems (e.g. Navas “System 1000 may include multiple APIs (application programming interfaces) that enable a user to interact with LE server 1002. APIs 1018 represent such interfaces”; see Navas Fig. 4, user provides query to LE node to access ERP 450 and CRM 460” [0104]).
As to Claim 65:
Navas in view of Futoransky discloses the computing system of claim 62 further comprising: enabling third-party access to the aggregated security-relevant information set (e.g. Navas “The event server returns the response to the user, 726. The user system may receive an actionable, real-time event, 728. An actionable event may allow the user to access an enterprise backend for additional information, launch actions, initiate processes, or other procedures” [0094]; Fig. 7, User System Receives Actionable, Real-Time Event Data 728).
As to Claim 67:
Navas in view of Futoransky discloses the computing system of claim 62 wherein the plurality of security-relevant information sets utilize a plurality of different formats (e.g. Navas “event data produced by a data source may be of a format that is inconsistent with the system through which the query was generated, or incompatible with the format expected by the user” [0036]).
As to Claim 69:
Navas in view of Futoransky discloses the computing system of claim 62 wherein the plurality of security-relevant subsystems includes one or more of: a data lake; a data log (e.g. Navas “Each element of hardware and software within the enterprise system may be referred to as a subsystem, or simply "system" (thus, the enterprise system may be considered a system of systems). The enterprise system as described herein includes data sources. The data sources may be any subsystem (e.g., supply chain management (SCM), enterprise resource planning (ERP), human resources, customer relations management (CRM), information technology (IT), etc.), database, or other element within the enterprise that implements a change to one or more objects (e.g., structured objects, including business objects that generally are part of a business context such as a "Customer" object). Each change to an object may be referred to as an event” [0026]); a security-relevant software application; a security-relevant hardware system; and a resource external to the computing platform.
Claims 48, 50, 56, 58, 64, and 66 are rejected under 35 U.S.C. 103 as being unpatentable over Navas in view of Futoransky as applied to Claims 46, 54, and 62, and further in view of LINDE et al. (US 20190132351 A1, hereinafter Linde).
As to Claim 48:
Navas in view of Futoransky discloses the computer-implemented method of claim 46, but does not specifically disclose:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
However, the analogous art Linde does disclose homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set (e.g. Linde standardizes or homogenizes the aggregated alerts (e.g., log sources) [0070]; [0071]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could be standardized or homogenized (Linde [0070]; [0071]). The suggestion/motivation for doing so would have been to enable the generation of cross solution data flow analysis to provide central monitoring of disparate monitoring systems and responding consistently to such systems (Linde [0070]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
As to Claim 50:
Navas in view of Futoransky discloses the computer-implemented method of claim 46 but does not specifically disclose:
enabling third-party searching of the aggregated security-relevant information set.
However, the analogous art Linde does disclose enabling third-party searching of the aggregated security-relevant information set (e.g. Linde “the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise… Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria [0096]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]; “FIG. 10H is a diagram of a user interface providing an embodiment of the aggregated enterprise system data flows. The visualizations combining individual data flows representing the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise. Thus this single view provides a large-scale overview of potential security issues which may not have been captured in other ways. For example, the overview may show certain personnel or departments are using/transporting much more data than would be expected which could indicate a potential data dump and/or improper use of enterprise data. Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria” [0096]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include enabling third-party searching of the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses that are aggregated (Navas [Abstract]-[0132]) and can be searched (Linde [0096]). The suggestion/motivation for doing so would have been to provide a large-scale overview of potential security issues that can be filtered based on search criteria (Linde [0096]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
As to Claim 56:
Navas in view of Futoransky discloses the computer program product of claim 54, but does not specifically disclose:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
However, the analogous art Linde does disclose homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set (e.g. Linde standardizes or homogenizes the aggregated alerts (e.g., log sources) [0070]; [0071]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could be standardized or homogenized (Linde [0070]; [0071]). The suggestion/motivation for doing so would have been to enable the generation of cross solution data flow analysis to provide central monitoring of disparate monitoring systems and responding consistently to such systems (Linde [0070]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
As to Claim 58:
Navas in view of Futoransky discloses the computer program product of claim 54, but does not specifically disclose:
enabling third-party searching of the aggregated security-relevant information set.
However, the analogous art Linde does disclose enabling third-party searching of the aggregated security-relevant information set (e.g. Linde “the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise… Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria [0096]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]; “FIG. 10H is a diagram of a user interface providing an embodiment of the aggregated enterprise system data flows. The visualizations combining individual data flows representing the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise. Thus this single view provides a large-scale overview of potential security issues which may not have been captured in other ways. For example, the overview may show certain personnel or departments are using/transporting much more data than would be expected which could indicate a potential data dump and/or improper use of enterprise data. Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria” [0096]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include enabling third-party searching of the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses that are aggregated (Navas [Abstract]-[0132]) and can be searched (Linde [0096]). The suggestion/motivation for doing so would have been to provide a large-scale overview of potential security issues that can be filtered based on search criteria (Linde [0096]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
As to Claim 64:
Navas in view of Futoransky discloses the computing system of claim 62, but does not specifically disclose:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.
However, the analogous art Linde does disclose homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set (e.g. Linde standardizes or homogenizes the aggregated alerts (e.g., log sources) [0070]; [0071]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could be standardized or homogenized (Linde [0070]; [0071]). The suggestion/motivation for doing so would have been to enable the generation of cross solution data flow analysis to provide central monitoring of disparate monitoring systems and responding consistently to such systems (Linde [0070]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
As to Claim 66:
Navas in view of Futoransky discloses the computing system of claim 62, but does not specifically disclose:
enabling third-party searching of the aggregated security-relevant information set.
However, the analogous art Linde does disclose enabling third-party searching of the aggregated security-relevant information set (e.g. Linde “the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise… Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria [0096]). Navas, Futoransky, and Linde are analogous art because they are from the same field of endeavor in data query and response management.
(e.g. Linde, “The data flow platform 101 further standardizes or homogenizes, as in step 503, the aggregated alerts (e.g., log sources) into distinct but uniform data flow steps… the data flow platform 101 provides centrally monitoring of the disparate monitoring systems and responding consistently to such systems” [0070]; “this standardized form permits the data flow platform 101, via the reporting module 219, to centrally generate diagrams from, request and manage responses to, or query these alerts regardless of the system that generated them, and enables the generation of cross solution data flow analysis” [0071]; “FIG. 10H is a diagram of a user interface providing an embodiment of the aggregated enterprise system data flows. The visualizations combining individual data flows representing the data flows within the system as a whole, may be aggregated into a single view. The single view of the aggregated data flows helps users attain a world view of the entire enterprise. Thus this single view provides a large-scale overview of potential security issues which may not have been captured in other ways. For example, the overview may show certain personnel or departments are using/transporting much more data than would be expected which could indicate a potential data dump and/or improper use of enterprise data. Finally the aggregated data flows may further be manipulated or filtered based on user defined inputs or other search criteria” [0096]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Linde before him or her, to modify the combination of Navas and Futoransky with the teachings of Linde to include enabling third-party searching of the aggregated security-relevant information set as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses that are aggregated (Navas [Abstract]-[0132]) and can be searched (Linde [0096]). The suggestion/motivation for doing so would have been to provide a large-scale overview of potential security issues that can be filtered based on search criteria (Linde [0096]; [0071]). Therefore, it would have been obvious to combine Navas, Futoransky, and Linde to obtain the invention as specified in the instant claim(s).
Claims 52, 60, and 68 are rejected under 35 U.S.C. 103 as being unpatentable over Navas in view of Futoransky as applied to Claims 46, 54, and 62, and further in view of Suit et al. (US 20100077078 A1, hereinafter Suit).
As to Claim 52:
Navas in view of Futoransky discloses the computer-implemented method of claim 22, but does not specifically disclose:
the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
However, the analogous art Suit does disclose the plurality of security-relevant information sets utilize a plurality of different nomenclatures (e.g. Suit the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points [0044]). Navas, Futoransky, and Suit are analogous art because they are from the same field of endeavor in data collection and response management.
(e.g. Suit, “the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points. Advantageously, this data may be normalized such that the AC is enabled to accurately map relationships between disparate operating systems correctly” [0044]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Suit before him or her, to modify the combination of Navas and Futoransky with the teachings of Suit to include the plurality of security-relevant information sets utilize a plurality of different nomenclatures as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could use different nomenclature (Suit [0044]). The suggestion/motivation for doing so would have been to provide a system that can normalize information from systems that use different nomenclature (Suit [0044]). Therefore, it would have been obvious to combine Navas, Futoransky, and Suit to obtain the invention as specified in the instant claim(s).
As to Claim 60:
Navas in view of Futoransky discloses the computer program product of claim 54, but does not specifically disclose:
the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
However, the analogous art Suit does disclose the plurality of security-relevant information sets utilize a plurality of different nomenclatures (e.g. Suit the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points [0044]). Navas, Futoransky, and Suit are analogous art because they are from the same field of endeavor in data collection and response management.
(e.g. Suit, “the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points. Advantageously, this data may be normalized such that the AC is enabled to accurately map relationships between disparate operating systems correctly” [0044]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Suit before him or her, to modify the combination of Navas and Futoransky with the teachings of Suit to include the plurality of security-relevant information sets utilize a plurality of different nomenclatures as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could use different nomenclature (Suit [0044]). The suggestion/motivation for doing so would have been to provide a system that can normalize information from systems that use different nomenclature (Suit [0044]). Therefore, it would have been obvious to combine Navas, Futoransky, and Suit to obtain the invention as specified in the instant claim(s).
As to Claim 68:
Navas in view of Futoransky discloses the computing system of claim 62, but does not specifically disclose:
the plurality of security-relevant information sets utilize a plurality of different nomenclatures.
However, the analogous art Suit does disclose the plurality of security-relevant information sets utilize a plurality of different nomenclatures (e.g. Suit the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points [0044]). Navas, Futoransky, and Suit are analogous art because they are from the same field of endeavor in data collection and response management.
(e.g. Suit, “the agent normalizes information collected from the node, with respect, for example, to the type of operating system associated with the node. For example, many operating systems use different nomenclature to represent physical devices addresses and network addresses which identify communication end points. Advantageously, this data may be normalized such that the AC is enabled to accurately map relationships between disparate operating systems correctly” [0044]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Navas, Futoransky, and Suit before him or her, to modify the combination of Navas and Futoransky with the teachings of Suit to include the plurality of security-relevant information sets utilize a plurality of different nomenclatures as claimed because Navas teaches a method and system for querying elements in an enterprise system by parsed query components that invoke source responses (Navas [Abstract]-[0132]) which could use different nomenclature (Suit [0044]). The suggestion/motivation for doing so would have been to provide a system that can normalize information from systems that use different nomenclature (Suit [0044]). Therefore, it would have been obvious to combine Navas, Futoransky, and Suit to obtain the invention as specified in the instant claim(s).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicants’ disclosure.
Singla (US 20140122461 A1)
Siva Kumar et al. (US 20160088000 A1)
Iyer et al. (US 20160306965 A1)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kenneth Chang whose telephone number is (571)270-7530. The examiner can normally be reached Monday - Friday 9:30am-5:30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KENNETH W CHANG/Primary Examiner, Art Unit 2438
PNG
media_image1.png
35
280
media_image1.png
Greyscale
09.08.2026
Prosecution Insights