Electrical substations play a crucial role in managing electrical energy, making them critical targets cyber-attacks on these systems could severely impact the general population, hospitals, and both critical and non-critical infrastructure. Several methods, from both academic than industrial world, propose anomaly detection in substation networks but currently there is a lacking of explainability on the reasons why an anomaly is detected. Moreover, privacy is also an issue, as a matter of fact current methods require that network logs are sent to a centralized server for model training, exposing sensitive and confidential network traces outside the electrical substation network infrastructure. To overcome both of these limitations, in this paper, we present an explainable and privacy-preserving approach for detecting possible anomalies within electrical substations. The proposed method analyzes network logs to identify potential anomalies in substation networks. We convert a network trace into an image and we consider a Vision Transformer model for anomaly detection. We also consider prediction explainability by highlighting specific areas in the image generated from the network trace that the classifier identifies as indicative of an anomaly, with the aim to visually show which area of the image is symptomatic of a possible anomaly.