In this paper, a data driven method for Wind Turbine system level anomaly detection and root sub-component identification is proposed. Supervisory control and data acquisition system (SCADA) data of WT is adopted and several parameters are selected based on physical knowledge in this domain and correlation coefficient analysis to build a normal behavior model. This model which is based on Self-organizing map (SOM) projects higher-dimensional SCADA data into a two-dimension-map. Afterwards, the Euclidean distance based indicator for system level anomalies is defined and a filter is created to screen out suspicious data points based on quantile function. Moreover, a failure data pattern based criterion is created for anomaly detection from system level. In order to track which sub-component should be responsible for an anomaly, a contribution proportion (CP) index is proposed. The method is tested with a two-month SCADA dataset with the measurement interval as 20 seconds. Results demonstrate capability and efficiency of the proposed method.