An action plan estimation apparatus 10 includes: an information acquisition unit 11 that acquires an operation log indicating an operation and a context information indicating a status of the operation for each operation performed by a software on a computer system, a group generation unit 12 that divides each of the operation logs into groups based on a similarity between the context information, an action plan estimation unit 13 that executes abduction for each group by applying knowledge data indicating a relationship between an action plan executed by the software and an operation of the software to the operation log included in the group, and uses the result of the abduction to estimate an action plan to reach a preset target state, that is executed by the software from which the operation log is acquired, based on the operation indicated by the operation log included in the group.