A computer-implemented method for detecting anomalous activity in a computing environment , the method comprising: receiving an input stream of data instances for a time series, where the data instances in the input stream are time stamped, each of the data instances comprising at least one principal value and a set of categorical attributes; generating anomaly scores for each of the data instances over continuous time intervals; detecting a change in the anomaly scores over the continuous time intervals for the data instances; and identifying which of the set of categorical attributes of the data instances caused the change in the anomaly scores; wherein the identification uses a counterfactual analysis comprising: removing at least a portion of the data instances; regenerating the anomaly scores for each of the data instances, that remained after the removing , over the continuous time intervals; and wherein if the regenerated anomaly scores are improved compared to the anomaly scores, at least a portion of the categorical attributes are identified as anomalous categorical attributes and a cause of the anomalous activity; or wherein the identification uses a regularity analysis comprising: identifying when a categorical attribute of the set of categorical attributes influences the anomaly score for the set of categorical attributes if an output of an anomaly detection algorithm is approximately identical to alternative instances in which the set of categorical attributes exists. receiving an input stream of data instances for a time series, where the data instances in the input stream are time stamped, each of the data instances comprising at least one principal value and a set of categorical attributes; generating anomaly scores for each of the data instances over continuous time intervals; detecting a change in the anomaly scores over the continuous time intervals for the data instances; and identifying which of the set of categorical attributes of the data instances caused the change in the anomaly scores; wherein the identification uses a counterfactual analysis comprising: removing at least a portion of the data instances; regenerating the anomaly scores for each of the data instances, that remained after the removing , over the continuous time intervals; and wherein if the regenerated anomaly scores are improved compared to the anomaly scores, at least a portion of the categorical attributes are identified as anomalous categorical attributes and a cause of the anomalous activity; or wherein the identification uses a regularity analysis comprising: identifying when a categorical attribute of the set of categorical attributes influences the anomaly score for the set of categorical attributes if an output of an anomaly detection algorithm is approximately identical to alternative instances in which the set of categorical attributes exists. removing at least a portion of the data instances; regenerating the anomaly scores for each of the data instances, that remained after the removing , over the continuous time intervals; and wherein if the regenerated anomaly scores are improved compared to the anomaly scores, at least a portion of the categorical attributes are identified as anomalous categorical attributes and a cause of the anomalous activity; or wherein the identification uses a regularity analysis comprising: identifying when a categorical attribute of the set of categorical attributes influences the anomaly score for the set of categorical attributes if an output of an anomaly detection algorithm is approximately identical to alternative instances in which the set of categorical attributes exists. <EOS>