1. A computer implemented method of identifying events in a process, the method comprising: running a principal component analysis model on sensor data from the process; calculating statistics related to the model; determining if an event is occurring; finding a nearest cluster of bad actors related to the event to identify the event; differentiating a sensor that directly senses the event from a sensor that senses a residual of the event; and storing the found nearest cluster of bad actors in a storage device.