US Patent 11244266 Incident response assisting device

The incident response assisting device includes: an incident extraction unit, a response procedure creation unit, and a screen display unit. The incident extraction unit performs an incident extraction process on an alert indicating that an incident has occurred in a monitored object and on log data of the monitored object, to extract incident information. The response procedure creation unit creates an incident response procedure corresponding to the incident on the basis of the incident information and a response procedure template. The screen display unit selects a display range from the incident response procedure in accordance with a progress status of response and displays the display range as a display response procedure.