Cyber-Physical Production Systems (CPPS) are becoming increasingly more susceptible to security vulnerabilities, specially with the introduction of IoT principles in manufacturing scenarios. Since security is crucial to the development and acceptance of CPPS, flexible adaptation to real CPPS security environment and reasonable response to real-time CPPS security events are needed. This paper presents an Intrusion Detection System (IDS) approach for CPPS, based on an extended version of the Dendritic Cell Algorithm (DCA), designated as Incremental Dendritic Cell Algorithm (iDCA). Facing the industrial requirements for intrusion detection and response, the proposed solution enables online incremental detection in an unsupervised manner. Results show that the approach is a viable solution to detect anomalies in (near) real-time, specially in environments with little a priori system knowledge for intrusion detection.