Abstract: An information presentation device includes an acquisition unit that acquires attack data including an attack technique in a cyberattack test, a search unit that searches for a method for using a security tool correlated with the attack technique, a generation unit that generates an instruction to request presentation of an attack instruction using the method for using the security tool found in the search, and an output unit that outputs attack instruction data including the attack instruction output from a model in response to an input of the instruction.

Abstract: Whether the information indicated by a plurality of pieces of text data describing an information security-related event is consistent is determined. An acquisition unit acquires a plurality of pieces of text data describing an information security-related event; an analysis unit analyzes whether information indicated by the pieces of acquired text data is consistent by using information security-related knowledge information; and an output unit outputs information based on an analysis result as to whether the information indicated by the pieces of text data is consistent.