Use case

In an investigation, the representation key used to display "File" observable is the "file name" and not the hashes (as in the observable list view) when composed with.

In the observable list view

The same observables in an investigation

It's therefore not possible to differentiate them.

Current Workaround

Proposed Solution

1. Use the observable "hashes" as the representation key in an investigation (to be coherent with the observable list view)
2. On tooltip, add additional information about the observable (all hashes, name and additional names)
3. Add more detail about the observable and globally the selected entity in the "Investigation Entity detail" card

Additional Information

Customer request

If the feature request is approved, would you be willing to submit a PR?