A detection rule output method is a detection rule output method for outputting a detection rule used in a security system that determines attack details based on log information of a vehicle, the detection rule output method including: acquiring vehicle configuration information regarding a configuration of an in-vehicle network provided in the vehicle, intrusion detection system (IDS) information regarding one or more intrusion detection systems (IDSes) mounted in the vehicle, and attack information to be detected regarding an attack on the vehicle to be detected; and outputting, to a storage device included in the security system, the detection rule that is a detection rule for detecting a location in the vehicle where an abnormality has occurred and the abnormality that has occurred in the location, and is generated based on the vehicle configuration information, the IDS information, and the attack information to be detected.