Entity labels now resolve like this for IP-based entities:

src/fgai/event_context.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import ipaddress
 from collections import Counter, defaultdict
 
-from .entities import ENTITY_FIELDS
+from .entities import entity_display
 from .logs import THREAT_ACTIONS, is_utm_event
 from .models import LogEvent
 from .normalization import canonical_value
@@ -13,30 +13,12 @@ def _entity(event: LogEvent) -> str:
     return event.src_ip or event.fields.get("user") or event.fields.get("username") or event.fields.get("hostname") or event.fields.get("source") or "unknown"
 
 
-def _related_value(events: list[LogEvent], fields: tuple[str, ...], *, exclude: str = "") -> str:
-    counts: Counter[str] = Counter()
-    excluded = exclude.lower()
-    for event in events:
-        for field in fields:
-            value = str(event.fields.get(field, "")).strip()
-            if not value or value in {"-", "unknown", "n/a"}:
-                continue
-            if excluded and value.lower() == excluded:
-                continue
-            counts[value] += 1
-    return counts.most_common(1)[0][0] if counts else ""
-
-
 def _display_label(entity: str, events: list[LogEvent]) -> dict[str, str]:
     try:
         ipaddress.ip_address(entity)
     except ValueError:
         return {"entity_display": entity, "entity_label": entity, "entity_detail": ""}
-    hostname = _related_value(events, ENTITY_FIELDS["host"], exclude=entity)
-    username = _related_value(events, ENTITY_FIELDS["user"], exclude=entity)
-    display = hostname or username or entity
-    label = f"{display} ({entity})" if display != entity else entity
-    return {"entity_display": display, "entity_label": label, "entity_detail": entity if display != entity else ""}
+    return entity_display("ip", entity, events)
 
 
 def build_event_context(events: list[LogEvent], *, source_limit: int = 30, sample_limit: int = 15) -> dict[str, object]: