A computer-implemented method for detecting and identifying advanced persistent threats (APTs) in networks, the method being executed by one or more processors and comprising: receiving first domain activity data (140a; 140b; 240; 340) from a first network domain and second domain activity data (140c; 140d; 242; 342) from a second network domain , the first domain activity data and the second domain activity data including a plurality of alerts (360; 362; 420; 422; 602; 602a; 602b; 602c; 602d; 602e) from the respective first and second network domains, each alert of the plurality of alerts resulting from one or more detected events in the respective first or second network domains; determining, for each alert of the plurality of alerts, a classification of the alert with respect to a cyber kill chain, wherein classification of the alert includes surveying one or more devices (112; 114; 120; 122; 124; 126; 128; 130) in the first network domain and/or the second network domain to gather information related to the alert and appending the gathered information to the alert to generate an enriched alert; determining, for each of one or more pairs of enriched alerts, a dependency; generating, from the plurality of enriched alerts, a graphical visualization (556; 600) of the plurality of enriched alerts, the graphical visualization comprising a plurality of nodes, and edges between nodes, each node corresponding to the cyber kill chain, and representing at least one enriched alert, and each edge representing a dependency between enriched alerts, wherein generating a graphical visualization of the plurality of enriched alerts further comprises generating an adversary prediction model, wherein for at least one enriched alert of the plurality of enriched alerts a prediction is made of the one or more steps that an adversary may take based at least in part on the graphical visualization to perform threat hunting and take countermeasures. receiving first domain activity data (140a; 140b; 240; 340) from a first network domain and second domain activity data (140c; 140d; 242; 342) from a second network domain , the first domain activity data and the second domain activity data including a plurality of alerts (360; 362; 420; 422; 602; 602a; 602b; 602c; 602d; 602e) from the respective first and second network domains, each alert of the plurality of alerts resulting from one or more detected events in the respective first or second network domains; determining, for each alert of the plurality of alerts, a classification of the alert with respect to a cyber kill chain, wherein classification of the alert includes surveying one or more devices (112; 114; 120; 122; 124; 126; 128; 130) in the first network domain and/or the second network domain to gather information related to the alert and appending the gathered information to the alert to generate an enriched alert; determining, for each of one or more pairs of enriched alerts, a dependency; generating, from the plurality of enriched alerts, a graphical visualization (556; 600) of the plurality of enriched alerts, the graphical visualization comprising a plurality of nodes, and edges between nodes, each node corresponding to the cyber kill chain, and representing at least one enriched alert, and each edge representing a dependency between enriched alerts, wherein generating a graphical visualization of the plurality of enriched alerts further comprises generating an adversary prediction model, wherein for at least one enriched alert of the plurality of enriched alerts a prediction is made of the one or more steps that an adversary may take based at least in part on the graphical visualization to perform threat hunting and take countermeasures. <EOS>