An information processing device capable of reducing an amount of data to be monitored in an onboard system is provided. The information processing device obtains a first log including, per unit time, some communication data flowing through the onboard system. The information processing device determines whether an abnormality is included in the communication data, using the first log. In a case where the abnormality is included in the communication data, the information processing device outputs first detection results to the onboard system. The first detection results cause transmission of a second log from the onboard system. The second log includes, per the unit time, more of the communication data than the first log.