A method for determining at least one machine involved in an anomaly detected in a computing infrastructure comprising a plurality M of machines, M being an integer strictly greater than 1, said method comprising the following steps implemented automatically: - Configuration of a state vector structure of dimension N of a machine, N being an integer strictly greater than 2, said structure distributing metric-type information and log-type information in N dimensions; - Determination of a time window duration; - Acquisition of timestamped operating data according to the configuration of the state vector and time window duration; - Construction of a state vector, for each of the M machines from the timestamped data acquired, according to the state vector structure configured, said construction comprising the following steps: ∘ Digitization of the data acquired according to the configuration of the state vector; ∘ Normalization of the digitized data; ∘ Aggregation of data by dimension; - Assembly of the M vectors of N dimension into an infrastructure vector; - Detection of an anomaly by applying an anomaly detection method to the infrastructure vector; - For the anomaly detected, the method further comprises the following additional steps: ∘ Application of an explanation method to the infrastructure vector producing an infrastructure explanation vector comprising M machine explanation vectors of N dimension; ∘ Separation of the explanation vector per machine; ∘ For each machine, aggregation of the components of the explanation vector to obtain an involvement indicator; ∘ Determination of the machine having the highest indicator, said determined machine then being considered as involved in the anomaly. - Configuration of a state vector structure of dimension N of a machine, N being an integer strictly greater than 2, said structure distributing metric-type information and log-type information in N dimensions; - Determination of a time window duration; - Acquisition of timestamped operating data according to the configuration of the state vector and time window duration; - Construction of a state vector, for each of the M machines from the timestamped data acquired, according to the state vector structure configured, said construction comprising the following steps: ∘ Digitization of the data acquired according to the configuration of the state vector; ∘ Normalization of the digitized data; ∘ Aggregation of data by dimension; ∘ Digitization of the data acquired according to the configuration of the state vector; ∘ Normalization of the digitized data; ∘ Aggregation of data by dimension; - Assembly of the M vectors of N dimension into an infrastructure vector; - Detection of an anomaly by applying an anomaly detection method to the infrastructure vector; - For the anomaly detected, the method further comprises the following additional steps: ∘ Application of an explanation method to the infrastructure vector producing an infrastructure explanation vector comprising M machine explanation vectors of N dimension; ∘ Separation of the explanation vector per machine; ∘ For each machine, aggregation of the components of the explanation vector to obtain an involvement indicator; ∘ Determination of the machine having the highest indicator, said determined machine then being considered as involved in the anomaly. ∘ Application of an explanation method to the infrastructure vector producing an infrastructure explanation vector comprising M machine explanation vectors of N dimension; ∘ Separation of the explanation vector per machine; ∘ For each machine, aggregation of the components of the explanation vector to obtain an involvement indicator; ∘ Determination of the machine having the highest indicator, said determined machine then being considered as involved in the anomaly.