Sharing system, sharing method, countermeasure device, and storage medium

1 . A sharing system comprising:

at least one memory storing a set of instructions; and

at least one processor configured to execute the set of instructions to:

receive countermeasure information from a countermeasure device configured to generate the countermeasure information representing a countermeasure against an abnormal state in a case where log information representing a security state of a target device indicates the abnormal state;

notify the target device of the received countermeasure information;

receive an effect of the countermeasure against the abnormal state from the countermeasure device that determines the effect of the countermeasure from the log information after notification of the countermeasure information;

provide effect information representing the effect, including countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information, to a predetermined effect information provision target;

receive a request for the countermeasure information indicated by the countermeasure reference destination information; and

provide the countermeasure information to a transmission source of the request for the countermeasure information in a case where the transmission source of the request for the countermeasure information is included in a predetermined countermeasure information provision target.

2 . The sharing system according to claim 1 , wherein

the at least one processor is further configured to execute the instructions not to provide the effect information in a case where a request for the effect information is received and a transmission source of the request for the effect information is not included in the effect information provision target.

3 . The sharing system according to claim 1 , wherein

the countermeasure information includes a countermeasure concealing period representing a period during which the countermeasure information is concealed, and

the at least one processor is further configured to execute the instructions not to provide the countermeasure information to the transmission source of the request for the countermeasure information in a case where a time when the request for the countermeasure information is received is included in the countermeasure concealing period of the countermeasure information.

4 . The sharing system according to claim 1 , wherein

the at least one processor is further configured to execute the instructions to:

provide the effect information including log reference destination information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information has occurred;

receive a request for the log information indicated by the log reference destination information; and

provide the log information to a transmission source of the request for the log information in a case where the transmission source of the request for the log information is included in a predetermined log information provision target.

5 . The sharing system according to claim 4 , wherein

the log information includes a log concealing period indicating a period during which the log information is concealed, and

the at least one processor is further configured to execute the instructions not to provide the log information to a transmission source of the request for the log information in a case where a time when the request for the log information is received is included in the log concealing period of the log information.

6 . The sharing system according to claim 1 , further comprising:

the at least one processor is further configured to execute the instructions to:

receive the log information from the target device; and

notify the countermeasure device of the log information.

7 . A countermeasure device comprising:

at least one second memory storing a set of instructions; and

at least one second processor configured to execute the set of instructions to:

receive log information indicating a security state output from a target device;

generate countermeasure information indicating a countermeasure against an abnormal state in a case where the log information indicates the abnormal state;

provide the countermeasure information;

determine an effect of the countermeasure from post-countermeasure log information that is log information received after the provision of the countermeasure information;

output effect information indicating the effect, wherein the effect information includes countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information;

receive a request for the countermeasure information indicated by the countermeasure reference destination information; and

provide the countermeasure information to a transmission source of the request for the countermeasure information in a case where the transmission source of the request for the countermeasure information is included in a predetermined countermeasure information provision target.

8 . The countermeasure device according to claim 7 , wherein

the at least one second processor is further configured to execute the instructions to

determine, in a case where the post-countermeasure log information no longer indicates the abnormal state, that the countermeasure is valid as the effect of the countermeasure.

9 . The countermeasure device according to claim 7 , wherein

the at least one second processor is further configured to execute the instructions to

determine, in a case where the post-countermeasure log information indicates the abnormal state after a lapse of a predetermined time from when the countermeasure information is provided, that the countermeasure is not valid as the effect of the countermeasure;

generate countermeasure information representing another countermeasure against the abnormal state in a case where it is determined that the countermeasure is not valid; and

provide the countermeasure information representing another countermeasure against the abnormal state.

10 . A sharing method comprising:

receiving countermeasure information from a countermeasure device that generates the countermeasure information representing a countermeasure against an abnormal state in a case where when the log information representing a security state of a target device indicates the abnormal state;

notifying the target device of the received countermeasure information;

receiving an effect of the countermeasure against the abnormal state from the countermeasure device that determines the effect of the countermeasure from log information after notification of the countermeasure information;

providing effect information representing the effect, including countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information, to a predetermined effect information provision target;

receiving a request for the countermeasure information indicated by the countermeasure reference destination information; and

providing the countermeasure information to a transmission source of the request for the countermeasure information in a case where the transmission source of the request for the countermeasure information is included in a predetermined countermeasure information provision target.

11 . The sharing method according to claim 10 , further comprising

not providing the effect information in a case where a request for the effect information is received and a transmission source of the request for the effect information is not included in the effect information provision target.

12 . The sharing method according to claim 10 , wherein

the countermeasure information includes a countermeasure concealing period representing a period during which the countermeasure information is concealed, and

the sharing method further includes

not providing the countermeasure information to the transmission source of the request for the countermeasure information in a case where a time when the request for the countermeasure information is received is included in the countermeasure concealing period of the countermeasure information.

13 . The sharing method according to claim 10 , further comprising:

providing the effect information including log reference destination information indicating a reference destination of the log information indicating the abnormal state in which the effect indicated by the effect information has occurred;

receiving a request for the log information indicated by the log reference destination information; and

providing the log information to a transmission source of the request for the log information in a case where when the transmission source of the request for the log information is included in a predetermined log information provision target.

14 . The sharing method according to claim 13 , wherein

the log information includes a log concealing period representing a period during which the log information is concealed, and

the sharing method further includes

not providing the log information to the transmission source of the request for the log information in a case where a time when the request for the log information is received is included in the log concealing period of the log information.

15 . The sharing method according to claim 10 , further comprising:

receiving the log information from the target device; and

notifying the countermeasure device of the log information.

16 . A non-transitory computer readable storage medium storing a program for causing a computer to execute:

countermeasure reception processing of receiving countermeasure information from a countermeasure device that generates countermeasure information indicating a countermeasure against an abnormal state in a case where log information indicating a security state of a target device indicates the abnormal state;

countermeasure notification processing of notifying the target device of the received countermeasure information;

effect reception processing of receiving the effect from the countermeasure device that determines the effect of the countermeasure against the abnormal state from the log information after notification of the countermeasure information;

effect information provision processing of providing effect information representing the effect, including countermeasure reference destination information indicating a reference destination of the countermeasure information of the countermeasure whose effect is represented by the effect information, to a predetermined effect information provision target;

countermeasure request reception processing of receiving a request for the countermeasure information indicated by the countermeasure reference destination information; and

countermeasure information provision processing of providing the countermeasure information to a transmission source of the request for the countermeasure information in a case where the transmission source of the request for the countermeasure information is included in a predetermined countermeasure information provision target.

17 . The non-transitory computer readable storage medium according to claim 16 , wherein

the effect information provision processing does not provides the effect information in a case where a request for the effect information is received and a transmission source of the request for the effect information is not included in the effect information provision target.