The incident response assisting device includes: an incident extraction unit, a response procedure creation unit, and a screen display unit. The incident extraction unit performs an incident extraction process on an alert indicating that an incident has occurred in a monitored object and on log data of the monitored object, to extract incident information. The response procedure creation unit creates an incident response procedure corresponding to the incident on the basis of the incident information and a response procedure template. The screen display unit selects a display range from the incident response procedure in accordance with a progress status of response and displays the display range as a display response procedure.
The incident extraction process is composed of a series of comparison processes in which a content of a comparison process to be subsequently performed is changed in accordance with a result of a previously performed comparison process.