Water supply networks are complex critical infrastructures, vulnerable to operational disruptions that can compromise service continuity and safety. Ensuring reliable operation requires not only detecting anomalies, but also understanding their evolution and impact on the network. Current approaches tend to focus on detecting specific anomalies, without providing a holistic view of incidents or explaining which parts are affected. This paper proposes a multi-stage method for detecting and characterising incidents in operational data. First, specific anomalies are identified in the data records. They are then grouped into temporal sequences that indicate possible incidents. At the same time, the original data is organised into homogeneous clusters with low entropy. Next, clusters and sequences of anomalies are integrated to precisely delimit the records involved in each incident. Finally, the original set is analysed to identify the characteristics that explain the anomalous behaviours, providing interpretative information on the factors affecting the infrastructure. The method was implemented in a prototype that considers a hybrid set of unsupervised algorithms and proprietary methods. Validation with real data from a drinking water distribution network in a city in south-eastern Spain demonstrates the system’s ability to isolate complete incidents and accurately identify the affected components. The method is domain-agnostic and can be applied to any critical infrastructure, requiring only timestamped multivariate records. This method allows for a practical and explainable characterisation of events, overcomes the limitations of traditional anomaly detection methods, and enables accurate diagnosis and rapid remediation.