In this paper an intrusion detection algorithm for cyber-physical technological systems is developed based on artificial immune system and danger theory approach. The algorithm uses cascade of two models: danger function which analyses physical properties and artificial immune system which analyzes cyber-physical system parameters. Danger function can be in the form of artificial neural network, for example a perceptron, and utilizes special training algorithm to produce reduced event flow to the second stage, which has higher computation complexity. Seconde stage is an artificial immune systems that implements a genetic algorithm with negative clonal selection of antibodies. Experimentation is performed on the SWaT dataset using both network and physical parts, results of the experiment are interpreted and limitations of the algorithm are described. It is conducted that the algorithm can be used for unsupervised intrusion detection in systems, where physical properties and network traffic can be collected synchronously, but it is sensible for duration of an attack.