Abstract: A query creation means 82 creates, in accordance with the threat event detected, at least one query for use in identification of, as a cause of a threat, an event caused by the user in the user terminal or an event that has occurred in the user terminal due to the threat from among events that the user becomes aware of. A query transmission and reception means 83 transmits the query created to the notification recipient associated with the user identified and receives an answer to the query from the user. An attack identification means 84 identifies, in an attack model representing phases of a series of attacks identified based on a type of the threat, a corresponding one of the phases based on the answer. A first response execution means 85 executes a first response to the threat indicated by the attack model in accordance with the phase identified.