An information processing device includes: a collection unit configured to collect an event log corresponding to an event generated in a control system including at least one network; an extraction and specification unit configured to extract at least one event log corresponding to an event generated arising from an identical factor from the collected event log, and to specify an event log representing the event generated arising from the identical factor in the at least one event log extracted; and an output unit configured to output the event log representing the event generated arising from the identical factor and event logs corresponding to other events generated arising from the identical factor while distinguishing the event log representing the event generated arising from the identical factor and the event logs corresponding to other events generated arising from the identical factor from each other.