1. A method for supporting an analysis of a root cause of an event, which has occurred in any of multiple management-target apparatuses, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses, and a conclusion event, which is a cause in a case where the one or more condition events have occurred, comprising: determining a first event group, which is multiple events presumed to occur as a result of the same cause, based on an event occurrence log including contents and an occurrence date and time of an event, which has occurred; creating a new rule in which the multiple events of the first event group are the condition events and one event of the first event group is the conclusion event; and storing the created new rule in the storage device.