A server includes: an obtainer that obtains items of information including an item of frame information regarding a communication frame transmitted on an in-vehicle network of each of a plurality of vehicles; and a generator that generates an integrated rule that is suitable for the items of information obtained by the obtainer and is for anomaly detection processing in the in-vehicle network of one of the vehicles; and a provider that outputs the integrated rule generated by the generator. For example, the obtainer obtains condition information indicating a condition pertaining to each of the plurality of vehicles at a time when the communication frame is transmitted on the in-vehicle network, and the generator generates the integrated rule using the items of frame information associated with the condition information.