An information processing device according to the present invention includes: a cluster analyzer that determines a cluster identifier indicating a cluster that is a result of classifying an alert, receives a classification result of the alert, and generates alert information that is information including the alert, the cluster identifier, and the classification result; a rule generator that calculates a number of occurrence times of a pattern that is a combination of information and includes the cluster identifier, extracts a frequent pattern, generates a classification rule used in setting of the classification result, and updates a previously generated old classification rule with a newly generated classification rule; and a rule applicator that sets the classification result included in the alert information.