diff --git a/ScalliGraph b/ScalliGraph
index 0dc00d560b..8566855f29 160000
--- a/ScalliGraph
+++ b/ScalliGraph
@@ -1 +1 @@
-Subproject commit 0dc00d560b7c48f5f7a781cd4c9861a64f56cd23
+Subproject commit 8566855f2909b5aef31f77be47aadfddf64c3f46
diff --git a/thehive/app/org/thp/thehive/controllers/v0/LogCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/LogCtrl.scala
index 4285118d2d..ca1bc469a4 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/LogCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/LogCtrl.scala
@@ -96,6 +96,10 @@ class PublicLog @Inject() (logSrv: LogSrv, organisationSrv: OrganisationSrv) ext
       .property("deleted", UMapping.boolean)(_.field.updatable)
       .property("startDate", UMapping.date)(_.rename("date").readonly)
       .property("status", UMapping.string)(_.select(_.constant("Ok")).readonly)
-      .property("attachment", UMapping.string)(_.select(_.attachments.value(_.attachmentId)).readonly)
+      .property("attachment.name", UMapping.string.optional)(_.select(_.attachments.value(_.name)).readonly)
+      .property("attachment.hashes", UMapping.hash.sequence)(_.select(_.attachments.value(_.hashes)).readonly)
+      .property("attachment.size", UMapping.long.optional)(_.select(_.attachments.value(_.size)).readonly)
+      .property("attachment.contentType", UMapping.string.optional)(_.select(_.attachments.value(_.contentType)).readonly)
+      .property("attachment.id", UMapping.string.optional)(_.select(_.attachments.value(_.attachmentId)).readonly)
       .build
 }
diff --git a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
index f7dbdb0221..629711357d 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
@@ -307,8 +307,9 @@ class PublicObservable @Inject() (
     .property("dataType", UMapping.string)(_.select(_.observableType.value(_.name)).readonly)
     .property("data", UMapping.string.optional)(_.select(_.data.value(_.data)).readonly)
     .property("attachment.name", UMapping.string.optional)(_.select(_.attachments.value(_.name)).readonly)
+    .property("attachment.hashes", UMapping.hash.sequence)(_.select(_.attachments.value(_.hashes)).readonly)
     .property("attachment.size", UMapping.long.optional)(_.select(_.attachments.value(_.size)).readonly)
     .property("attachment.contentType", UMapping.string.optional)(_.select(_.attachments.value(_.contentType)).readonly)
-    .property("attachment.hashes", UMapping.hash)(_.select(_.attachments.value(_.hashes)).readonly)
+    .property("attachment.id", UMapping.string.optional)(_.select(_.attachments.value(_.attachmentId)).readonly)
     .build
 }
diff --git a/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala
index bf4393a499..2f46fa2bb9 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/UserCtrl.scala
@@ -117,7 +117,6 @@ class UserCtrl @Inject() (
               .update(userSrv.get(EntityIdOrName(userId)), propertyUpdaters) // Authorisation is managed in public properties
               .flatMap { case (user, _) => user.richUser.getOrFail("User") }
         } yield Results.Ok(user.toJson)
-
       }
 
   def setPassword(userId: String): Action[AnyContent] =
diff --git a/thehive/app/org/thp/thehive/controllers/v1/Properties.scala b/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
index fa40aae20b..4f1122e467 100644
--- a/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
+++ b/thehive/app/org/thp/thehive/controllers/v1/Properties.scala
@@ -435,7 +435,11 @@ class Properties @Inject() (
       .property("message", UMapping.string)(_.field.updatable)
       .property("deleted", UMapping.boolean)(_.field.updatable)
       .property("date", UMapping.date)(_.field.readonly)
-      .property("attachment", UMapping.string)(_.select(_.attachments.value(_.attachmentId)).readonly)
+      .property("attachment.name", UMapping.string.optional)(_.select(_.attachments.value(_.name)).readonly)
+      .property("attachment.hashes", UMapping.hash.sequence)(_.select(_.attachments.value(_.hashes)).readonly)
+      .property("attachment.size", UMapping.long.optional)(_.select(_.attachments.value(_.size)).readonly)
+      .property("attachment.contentType", UMapping.string.optional)(_.select(_.attachments.value(_.contentType)).readonly)
+      .property("attachment.id", UMapping.string.optional)(_.select(_.attachments.value(_.attachmentId)).readonly)
       .build
 
   lazy val user: PublicProperties =
@@ -480,6 +484,10 @@ class Properties @Inject() (
       .property("tlp", UMapping.int)(_.field.updatable)
       .property("dataType", UMapping.string)(_.select(_.observableType.value(_.name)).readonly)
       .property("data", UMapping.string.optional)(_.select(_.data.value(_.data)).readonly)
-      // TODO add attachment ?
+      .property("attachment.name", UMapping.string.optional)(_.select(_.attachments.value(_.name)).readonly)
+      .property("attachment.hashes", UMapping.hash.sequence)(_.select(_.attachments.value(_.hashes)).readonly)
+      .property("attachment.size", UMapping.long.optional)(_.select(_.attachments.value(_.size)).readonly)
+      .property("attachment.contentType", UMapping.string.optional)(_.select(_.attachments.value(_.contentType)).readonly)
+      .property("attachment.id", UMapping.string.optional)(_.select(_.attachments.value(_.attachmentId)).readonly)
       .build
 }
diff --git a/thehive/app/org/thp/thehive/services/th3/Aggregation.scala b/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
index 358d5a744b..90032f84dc 100644
--- a/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
+++ b/thehive/app/org/thp/thehive/services/th3/Aggregation.scala
@@ -177,7 +177,7 @@ case class AggAvg(aggName: Option[String], fieldName: String) extends Aggregatio
       traversal: Traversal.Unk,
       authContext: AuthContext
   ): Traversal.Domain[Output[_]] = {
-    val fieldPath = if (fieldName.startsWith("computed")) FPathElem(fieldName) else FPath(fieldName)
+    val fieldPath = FPath(fieldName)
     val property = publicProperties
       .get[Traversal.UnkD, Traversal.UnkDU](fieldPath, traversalType)
       .getOrElse(throw BadRequestError(s"Property $fieldName for type $traversalType not found"))