Threat monitor, threat monitoring method, and recording medium therefore

Abstract

A monitor for monitoring a monitored object comprises: a processor configured to execute a program; a storage device configured to store the program; and a communication interface capable of communicating with the monitored object, wherein the processor is configured to execute: acquisition processing for acquiring threat information indicating association of a plurality of events necessary for an occurrence of a threat; and determination processing for determining, as a collection scheme of a log from the monitored object according to a rule for detecting an attack on the monitored object, either a passive scheme for collecting the log transmitted from the monitored object or an active scheme for collecting from the monitored object the log requested from the monitor to the monitored object.