Warning apparatus, control method, and program

A control method executed by a computer, the method comprising:

• a first generation step of acquiring first detected event information representing, at a first abstraction level, an event set being a set of events having occurred in a target system, and generating second detected event information representing, at a second abstraction level, the event set represented by the acquired first detected event information;
• a determination step of determining, from among a plurality of pieces of threat information each representing a threat activity, the threat information having a high degree of relevance to at least either of the first detected event information and the second detected event information;
• and
• a second generation step of generating warning information relating to a threat being occurring in the target system, based on the determined threat information and a matching level being an abstraction level associated with the detected event information having a high degree of relevance to the threat information.

A non-transitory computer readable medium storing a program causing a computer to execute each of steps of a control method, the method comprising:

• acquiring first detected event information representing, at a first abstraction level, an event set being a set of events having occurred in a target system, and generating second detected event information representing, at a second abstraction level, the event set represented by the acquired first detected event information;
• determining, from among a plurality of pieces of threat information each representing a threat activity, the threat information having a high degree of relevance to at least either of the first detected event information and the second detected event information;
• and
• generating warning information relating to a threat being occurring in the target system, based on the determined threat information and a matching level being an abstraction level associated with the detected event information having a high degree of relevance to the threat information.