Cyber-Physical Systems (CPS) are complex - often too complex to be easily modelled. However, a compact system model is vital for applications like monitoring the correctness during online operation. The presentation will discuss both aspects - learning a compact model of a CPS and how to detect problems in the running system. We discuss two complementary approaches. First, by learning discrete models that may be applied for monitoring including theoretical limitations of the learning approaches. Second, we explain how behavioural anomalies can be interpreted as malfunctions of an observed system. Using a general data-driven approach, various machine learning techniques can detect anomalies. In both parts, we present the levels from application to implementation.