1. A method for supporting an analysis of a root cause of an event, which has occurred in any of multiple management-target apparatuses which are managed by a control device, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses, and a conclusion event, which is a cause in a case where the one or more condition events have occurred, the method comprising the steps, performed by the control device, of: determining a first event group, which is multiple events presumed to occur as a result of a same cause, by calculating co-occurrence probabilities of a plurality of events which have occurred based on an event occurrence log including contents and an occurrence date and time of the plurality of events which have occurred; creating a new rule in which one event of the first event group is the conclusion event for the new rule and a remainder of the multiple events are the condition events; and storing the created new rule in the storage device, wherein the storage device is configured to store one or more existing rules, which denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a respective conclusion event, which is the cause in a case where the one or more condition events have occurred, and an analysis log, which includes information for identifying an existing rule which has been used in an analysis of a root cause.