A vehicle apparatus, comprising: a plurality of in-vehicle apparatuses installed in a vehicle; a determiner that determines whether or not a malicious attack is being carried out on the plurality of in-vehicle apparatuses based on anomaly detection in the plurality of in-vehicle apparatuses, and a controller that, in accordance with a depth of penetration of a malicious attack, changes at least one of a communication method with an outside of the vehicle or a defense method against the malicious attack, and changes a storage method for logs pertaining to the plurality of in-vehicle apparatuses, based on an anomaly occurrence order in the plurality of in-vehicle apparatus, wherein the determiner determines that the malicious attack is being carried out when the anomaly occurrence order matches a predetermined order, and the predetermined order is an order in which at least two in-vehicle apparatuses of the plurality of in-vehicle apparatuses are arranged from close to an external network to far from the external network in a predetermined penetration route, wherein the in-vehicle apparatus close to the external network is an information-related in-vehicle apparatus which has a shallow relationship with a drive control of the vehicle, whereas the in-vehicle apparatus far from the external network is a control-related in-vehicle apparatus which has a deep relationship with the drive control of the vehicle, wherein when changing the storage method in accordance with the depth of penetration of the malicious attack, the controller changes the storage method by changing an in-vehicle apparatus that is used as a storage location of the logs, among the plurality of in-vehicle apparatuses, in accordance with the depth of penetration. a plurality of in-vehicle apparatuses installed in a vehicle; a determiner that determines whether or not a malicious attack is being carried out on the plurality of in-vehicle apparatuses based on anomaly detection in the plurality of in-vehicle apparatuses, and a controller that, in accordance with a depth of penetration of a malicious attack, changes at least one of a communication method with an outside of the vehicle or a defense method against the malicious attack, and changes a storage method for logs pertaining to the plurality of in-vehicle apparatuses, the predetermined order is an order in which at least two in-vehicle apparatuses of the plurality of in-vehicle apparatuses are arranged from close to an external network to far from the external network in a predetermined penetration route, wherein the in-vehicle apparatus close to the external network is an information-related in-vehicle apparatus which has a shallow relationship with a drive control of the vehicle, whereas the in-vehicle apparatus far from the external network is a control-related in-vehicle apparatus which has a deep relationship with the drive control of the vehicle, wherein when changing the storage method in accordance with the depth of penetration of the malicious attack, the controller changes the storage method by changing an in-vehicle apparatus that is used as a storage location of the logs, among the plurality of in-vehicle apparatuses, in accordance with the depth of penetration.