Setting or verification of a monitoring rule in response to a monitoring target environment is supported. An information processing system includes a situation information receiving unit that receives an input of situation information indicating a situation in a monitoring target environment. The information processing system further includes a normal situation storage unit. The normal situation storage unit stores environment information indicating the monitoring target environment in association with a set of situation information indicating a situation that is not abnormal in the monitoring target environment. The information processing system further includes a retrieval unit. The retrieval unit refers to the normal situation storage unit upon receiving the input of the situation information indicating the information in the monitoring target environment. The retrieval unit then retrieves the environment information associated with the set of the situation information that does not include the input situation information.