Incident response assisting device

An incident response assisting device for assisting a user who performs response work when a security incident has occurred, the incident response assisting device comprising:

• a processor for executing a program;
• and
• a memory or a hard disk for storing the program, wherein
• the following operation is performed by the program executed by the processor,
• acquiring incident detection information indicating that an incident has occurred in a monitored object,
• acquiring log data of the monitored object,
• performing an incident extraction process on the incident detection information and the log data to extract incident information that identifies the incident that has occurred in the monitored object,
• creating an incident response procedure corresponding to the incident that has occurred in the monitored object, on the basis of the incident information and a response procedure template created in advance, and
• displaying the incident response procedure, and
• the incident extraction process is composed of a series of comparison processes in which a content of a comparison process to be subsequently performed is changed in accordance with a result of a previously performed comparison process.