How do I find an attacker already inside the network?

You can hunt now. What still eludes you is the hardest catch of all, the attacker who is already inside and moving quietly, careful to look like normal traffic. That one is meant to be missed. Not finding it easily is not a failure of skill, it is the whole design of a patient intruder. An attacker inside cannot help but leave faint traces, because they have to move, look around, and reach for things, and each of those brushes against what is normal. The hunt is for the small wrongness, an account touching systems it never touched before, activity at an hour that account never keeps, a connection that should not exist. You find them not by looking for an alarm but by knowing normal so well that their careful blending still leaves a ripple. Pick one thing an intruder would have to do, move between machines, say, and go looking specifically for the quiet version of that, assuming it is already happening. Hunting with the assumption that they are in changes what you look for. You are not waiting for a tool to shout. You are searching for the ripple a careful enemy could not avoid making.