Rule generation apparatus, rule generation method, and program

To enable more accurate determination of a failure cause event, an event mapping acquiring unit acquires an event mapping file defining a normalized alarm message indicating a normalized alarm content, a resource type indicating an event failure location, an alarm type, and an event type indicating event classification of the alarm in association with one another. An event type conversion unit determines whether input alarm information matches the definition of the event mapping file acquired, when the input alarm information matches the definition, sets the event type to a value defined in the event mapping file, when the input alarm information does not match the definition, sets the event type to the alarm type of alarm information, and registers the event type and the alarm information in association with each other as a failure event in the database.