A network monitor device 20 includes: a communication cutoff unit 21 to cut off at least a part of communications performed by a quarantine target node 90; a redirect unit to make the quarantine target node 90 establish a communication connection for a quarantine process with a quarantine server 30 which executes the quarantine process of the quarantine target node 90; a cancel request receiving unit 24 to receive, when the quarantine target node 90 receives a ticket indicating completion of the quarantine via the communication connection for the quarantine process from the quarantine server 30, a cutoff cancel request ticket transmitted by the quarantine target node 90; and a cutoff canceling unit 26 to cancel the cutoff by the communication cutoff unit 21 when receiving the cutoff cancel request.