Principle Component Analysis (PCA) is used to model a process, and clustering techniques are used to group excursions representative of events based on sensor residuals of the PCA model. The PCA model is trained on normal data, and then run on historical data that includes both normal data, and data that contains events. Bad actor data for the events is identified by excursions in Q (residual error) and T2 (unusual variance) statistics from the normal model, resulting in a temporal sequence of bad actor vectors. Clusters of bad actor patterns that resemble one another are formed and then associated with events.