Both kill chains depend on correlating data from many sources, with provenance on every link. Tell us where your analysts see the pieces but cannot connect them, and we will scope a working session.
Your chain problem. Your sensors and reporting. Real work.