UPClytics
EnglishDeutsch
Sign inSign up
View all cases

UPC CFI 660/2024

Nov 7, 2024·EP3652914: CYBERANALYSIS WORKFLOW ACCELERATION

Case details
Status
Case Closed
Action
Infringement
Category
Main Infringement Action
Parties
Claimants
Reps: Armin Kühne
Respondents
Reps: Henrik Lehment
Division
Mannheim LD
Judges
Technology
Software & Computing · Cybersecurity · Computing & AI
Language
English
First decided
Dec 19, 2025
Claims
At issue1, 2, 10, 14
Revokedall
Notes: EP 3 652 914 entirely revoked in France and Germany; unconditionally amended main request (claims 1, 2, 10, 14) and all auxiliary request amendments (claims 1-12) lacked inventive step.
Decisions
  • 2025-12-19
    RevokedInfringement meritsInfringement Action

    The Court revoked European patent EP 3 652 914 B1 in its entirety in the territories of France and Germany on the basis of the counterclaim for revocation filed by Palo Alto Networks. The claims (including the unconditionally amended main request and all auxiliary requests) were found to lack inventive step in light of the prior art. As a consequence, the infringement action was dismissed. Centripetal was ordered to bear the costs of the litigation. The value in dispute was set at EUR 2 million (EUR 1 million each for the infringement action and counterclaim).

    Legal issues:Lack of inventive stepClaim amendment under R.30.1 RoPCounterclaim for revocationMethods and systems for cyberanalysis workflow
Documents
Document titleDatePublic
Hearing recording reference document2026-04-13Not public
Receipt2026-01-19Not public
Cover sheet2026-01-19Not public
Exhibit document Respondent2026-01-19Not public
Exhibit document Respondent2026-01-19Not public
Exhibit document Respondent2026-01-19Not public
Application document Respondent2026-01-19Not public
action.phaseChange.caseClose2025-12-22Not public
action.issueDecision.decision2025-12-19Not public
Decision2025-12-19Public
action.phaseChange.oralPhaseOpen2025-11-13Not public
Other Documents2025-11-13Public
action.phaseChange.oralPhaseOpen2025-11-13Not public
Other Documents2025-11-13Public
Cover sheet2025-11-13Not public
Further pleadings2025-11-13Not public
Exhibit document Claimant2025-11-13Not public
Receipt2025-11-13Not public
Cover sheet2025-11-13Not public
Other document Defendant2025-11-13Not public
Exhibit document Defendant2025-11-13Not public
Receipt2025-11-13Not public
Other Documents2025-11-13Not public
Other Documents2025-11-13Not public
Other Documents2025-11-13Not public
Cover sheet2025-11-11Not public
Other document Defendant2025-11-11Not public
Receipt2025-11-11Not public
Cover sheet2025-11-11Not public
Further pleadings2025-11-11Not public
Receipt2025-11-11Not public
action.issueOrder.order2025-11-05Not public
Order2025-11-05Public
Cover sheet2025-11-05Not public
Application document Claimant2025-11-05Not public
Receipt2025-11-05Not public
action.issueOrder.order2025-11-04Not public
Order2025-11-04Public
action.phaseChange.interimPhaseOpen2025-10-02Not public
Other Documents2025-10-02Public
action.issueOrder.order2025-09-24Not public
Order2025-09-24Not public
Panel-Appointment2025-09-05Not public
Acknowledgement-of-lodging2025-07-14Not public
HL 112025-07-14Not public
HL 142025-07-14Not public
HL 132025-07-14Not public
2025-07-14_-_EP_914_Palo_Alto_Rejoinder_ACT_59828_2024 - signed2025-07-14Not public
HL 102025-07-14Not public
HL 122025-07-14Not public
Headnote-and-Keywords2025-06-27Not public
Outcome of the Order2025-06-27Not public
Final order extension time period2025-06-27Public
Template-Order2025-06-27Not public
2025.06.26_Noerr_Statement_Deadline_ACT_59828_20242025-06-26Not public
invitation to comment2025-06-24Not public
Receipt2025-06-24Not public
Palo Alto Networks - request for extension of deadline2025-06-21Not public
Acknowledgement-of-lodging2025-04-28Not public
Exhibit_C_42_Excerpt_from_Defendants_website_Incidents_table_view2025-04-28Not public
Exhibit_C_44_Excerpt_from_Defendants_website_Locations2025-04-28Not public
2025.04.28_Noerr_Reply_to_SoD_ACT_59828_20242025-04-28Not public
Exhibit_C_45_Excerpt_from_Defendants_website_Cortex_Server2025-04-28Not public
Exhibit_C_43_Screenshot_from_Youtubevideo2025-04-28Not public
final order Art. 33 (3) UPCA2025-04-01Public
Hearing-Dates2025-03-25Not public
order R 28 RoP2025-03-25Public
Order R 28 RoP2025-03-25Not public
Hearing-Dates2025-03-25Not public
20250319_Noerr_Statement re Art. 33(3)(a) UPCA2025-03-19Not public
Panel-Appointment2025-03-19Not public
Comments Palo Alto Networks2025-03-18Not public
Order invitation to comment on Art. 33 (3) UPCA2025-03-13Not public
Formal-checks_Notification-of-positive-outcome2025-02-28Not public
Acknowledgement-of-lodging2025-02-28Not public
HL 92025-02-28Not public
HL 82025-02-28Not public
HL 62025-02-28Not public
HL 72025-02-28Not public
HL 32025-02-28Not public
HL 22025-02-28Not public
HL 52025-02-28Not public
HL 42025-02-28Not public
2025-02-28 - EP 914 - Palo Alto Networks Statement of Defence ACT_59828_2024 - signed2025-02-28Not public
HL 12025-02-28Not public
HL 3a2025-02-28Not public
Acknowledgement of access to case2024-12-02Not public
Notification Of Service2024-12-02Not public
Panel-Appointment2024-11-18Not public
Panel-Appointment2024-11-14Not public
Panel-Appointment2024-11-14Not public
communicationCheck2024-11-13Not public
Document from EPO2024-11-12Not public
EPO-Request-for-case-pending2024-11-08Not public
Receipt2024-11-08Not public
Formal-checks_Notification-of-positive-outcome2024-11-08Not public
Acknowledgement-of-lodging2024-11-07Not public
Exhibit C072024-11-07Not public
Exhibit C392024-11-07Not public
Exhibit C182024-11-07Not public
Exhibit C322024-11-07Not public
Exhibit C302024-11-07Not public
Exhibit C122024-11-07Not public
Exhibit C282024-11-07Not public
Exhibit C052024-11-07Not public
Exhibit C162024-11-07Not public
Exhibit C292024-11-07Not public
Exhibit C412024-11-07Not public
Exhibit C252024-11-07Not public
Exhibit C332024-11-07Not public
Exhibit C082024-11-07Not public
Exhibit C032024-11-07Not public
Exhibit C272024-11-07Not public
Court Fee Payment Slip2024-11-07Not public
Exhibit C342024-11-07Not public
Exhibit C012024-11-07Not public
Exhibit C112024-11-07Not public
Exhibit C102024-11-07Not public
Exhibit C022024-11-07Not public
Exhibit C142024-11-07Not public
Exhibit C152024-11-07Not public
Exhibit C362024-11-07Not public
Exhibit C402024-11-07Not public
Exhibit C192024-11-07Not public
Exhibit C262024-11-07Not public
Statement of Claim2024-11-07Not public
Exhibit C352024-11-07Not public
Exhibit C062024-11-07Not public
Exhibit C092024-11-07Not public
Exhibit C222024-11-07Not public
Exhibit C202024-11-07Not public
Exhibit C132024-11-07Not public
Exhibit C232024-11-07Not public
Exhibit C372024-11-07Not public
Exhibit C382024-11-07Not public
Exhibit C242024-11-07Not public
Exhibit C312024-11-07Not public
Exhibit C172024-11-07Not public
Exhibit C042024-11-07Not public
Exhibit C212024-11-07Not public
Coverage: Partial.Reasoning extracted with partial coverage — some sections may be incomplete.
Plain-English summary

Centripetal Limited sued Palo Alto Networks for infringement of EP 3 652 914 B1 (cyberanalysis workflow acceleration using machine-learning-based event log triage) for the German and French parts. Palo Alto Networks counterclaimed for revocation; the Mannheim Local Division revoked the patent in full for both territories, finding all 12 claim amendment groups and the unconditionally amended main request lacked inventive step over prior art (principally HLCC17 on n-gram/polygram analysis of domain names), and accordingly dismissed the infringement action.

Accepted arguments
What the court agreed with — by party.

  • Claims of EP 3 652 914 (including unconditionally amended main request and all auxiliary requests) lack inventive step over prior art

    RespondentLegal basis: Art. 56 EPC; problem-solution approach; inventive step

    Note: Mannheim Local Division accepted Palo Alto Networks' revocation counterclaim, finding all claim versions (including 12 amendment groups) lacked an inventive step over the prior art, in particular HLCC17 and related references.

  • N-gram/polygram probability distribution concept from prior art (HLCC17) renders claim features relating to reportability likelihood determination obvious

    RespondentLegal basis: Art. 56 EPC; obviousness

    Note: Court held that applying n-gram vectors to domain names generally renders features requiring such analysis for the leading label of the effective 2nd-level domain of a FQDN obvious; the concept was not limited to file paths.

Rejected arguments
What the court did not agree with — and why.

  • Unconditionally amended main request and auxiliary requests 1–12 should be maintained

    ClaimantLegal basis: Art. 56 EPC

    Reason: Each claim amendment was found to lack inventive step over the prior art (primarily HLCC17); the combination of all features in amendment 12 similarly provided no inventive step.

  • HLCC17 only discloses n-gram vectors applied to URL filepaths, not domain names generally

    ClaimantLegal basis: Art. 56 EPC

    Reason: Court found HLCC17 discloses the n-gram concept for domain names generally, not limited to filepaths; even if limited to filepaths, applying it to other URL components including second-level domains would not involve an inventive step.

Key legal principles
Doctrines and rules cited in the reasoning.
All claim amendments evaluated for inventive step; no 'safe harbour' in amendment merely by adding features already disclosed in prior artGeneralisation of a prior-art concept from one technical sub-domain to a related one does not involve an inventive stepRevocation of patent defeats infringement action regardless of infringement merits

Browse other cases on this principle.

Prior art relied on
References cited and the role they played.
  • HLCC17Obviousness combination
Claim construction notes

The court construed claim features relating to 'reportability likelihood' determination and the use of polygram (n-gram) probability distributions applied to the leading label of the effective second-level domain of a fully qualified domain name. Claim amendment 10's feature CA10-1.4.2.2.1.2 does not preclude further entropy values being used, but the second-level domain feature was rendered obvious by HLCC17's general teaching on domain name analysis.