An information processing device capable of reducing an amount of data to be monitored in an onboard system is provided. The information processing device obtains a first log from the onboard system, determines whether an abnormality is included in communication data of the first log using the first log, and, in a case where the abnormality is determined to be included in the communication data, outputs first detection results indicating that the abnormality is included in the communication data to the onboard system. The first detection results is output, as a transmission instruction to cause transmission of a second log from the onboard system to the information processing device, with the second log including a larger amount of data than the first log.