An information processing device for discovering a main event generated in a control system comprising at least one network, wherein the control system includes plural devices each of which is connected to the network and is configured to detect an abnormality and to generate an event log corresponding to the detected abnormality, the information processing device comprising: a detection unit configured to collect the event logs (101A, 151 A-D) generated by the devices in the control system, extract, from the collected event logs (101A, 151 A-D), the event logs (101A, 151 A-D) in which generation times are close to each other as the event logs (101A, 151 A-D) arise from the main event, specify, based on a network configuration of the control system, in the extracted event logs a main event log caused by the main event, and secondary event logs which are generated secondarily, a connection configuration expression unit configured to visually express a physical connection and a logical connection of the network comprised in the control system; an event output unit configured to output the main event specified by the detection unit while correlating the main event with the physical connection and the logical connection of the network, the physical connection and the logical connection being visually expressed on a user interface screen (500 A - I, 550), in response to a selection of one of a plurality of objects (508, 510, 512, 520, 526, 528, 530, 544, 546, 548, 550, 552) displayed on the user interface screen (500 A - I, 550), the event output unit is configured to display the extracted event logs correlated with the selected object, and wherein the event output unit is configured to extract, in response to a selection of one of the displayed event logs, the main event log (101A, 151 A-D) representing the main event which causes the selected event log (101A, 151 A-D) and to visually indicate a place where the main event log is generated. a detection unit configured to collect the event logs (101A, 151 A-D) generated by the devices in the control system, extract, from the collected event logs (101A, 151 A-D), the event logs (101A, 151 A-D) in which generation times are close to each other as the event logs (101A, 151 A-D) arise from the main event, specify, based on a network configuration of the control system, in the extracted event logs a main event log caused by the main event, and secondary event logs which are generated secondarily, collect the event logs (101A, 151 A-D) generated by the devices in the control system, extract, from the collected event logs (101A, 151 A-D), the event logs (101A, 151 A-D) in which generation times are close to each other as the event logs (101A, 151 A-D) arise from the main event, specify, based on a network configuration of the control system, in the extracted event logs a main event log caused by the main event, and secondary event logs which are generated secondarily, a connection configuration expression unit configured to visually express a physical connection and a logical connection of the network comprised in the control system; an event output unit configured to output the main event specified by the detection unit while correlating the main event with the physical connection and the logical connection of the network, the physical connection and the logical connection being visually expressed on a user interface screen (500 A - I, 550), in response to a selection of one of a plurality of objects (508, 510, 512, 520, 526, 528, 530, 544, 546, 548, 550, 552) displayed on the user interface screen (500 A - I, 550), the event output unit is configured to display the extracted event logs correlated with the selected object, and wherein the event output unit is configured to extract, in response to a selection of one of the displayed event logs, the main event log (101A, 151 A-D) representing the main event which causes the selected event log (101A, 151 A-D) and to visually indicate a place where the main event log is generated.