A new diagnostic benchmark called DiagChain evaluates whether large language model agents can reliably perform attack chain reconstruction, the process of piecing together an attacker's ordered actions from system telemetry. Developed by researchers including Xuyang Liu, Yibin Han, Zhenwei Zhang, Kai Chang, Zhiwei Xu, Tian Qiu, Weixian Deng, Jiabao Gao, Xiaolin Peng, Hai Wan, and Xibin Zhao, DiagChain assesses each stage of an agent's reasoning process separately—evidence gathering, evidence interpretation, and event ordering—rather than only grading final outputs. The benchmark's centerpiece is MAIN-69, a suite of 69 scenarios spanning multiple operating systems, varying noise levels in evidence, and different chain lengths. DiagChain also introduces ECRAG, an Evidence-Centric Retrieval-Augmented Generation method that couples evidence retrieval with an evolving structured representation of the attack chain, continuously updating its internal picture as new evidence arrives. A five-part scoring system aims to make failure diagnosis systematic. The results suggest the technology still has a long way to go before it can reliably handle attack chain reconstruction on its own.