diff --git a/backend/modules/alerts/usecase/adversary.go b/backend/modules/alerts/usecase/adversary.go
index c3a8abee8..0ea2d51ff 100644
--- a/backend/modules/alerts/usecase/adversary.go
+++ b/backend/modules/alerts/usecase/adversary.go
@@ -16,6 +16,12 @@ import (
 // adversaryIndexPattern is the OpenSearch index the adversary aggregation reads.
 const adversaryIndexPattern = "v11-alert-*"
 
+// alertSourceIncludes trims top_hits _source to only fields the frontend renders
+// plus `id` (needed by parseAdversaryAggs to correlate children to parents).
+// Cuts per-doc payload from full alerts (KBs) to ~4 scalar fields, keeping the
+// circuit-breaking parent breaker from tripping on wide time ranges.
+var alertSourceIncludes = []string{"id", "name", "target", "severity"}
+
 // adversaryBucketAggs is the set of sub-aggregations run under each adversary
 // bucket (by host or by IP) — shared so both grouping strategies fetch the
 // same shape of data.
@@ -49,6 +55,9 @@ func adversaryBucketAggs() map[string]any {
 						"sort": []map[string]any{
 							{"@timestamp": map[string]any{"order": "desc"}},
 						},
+						"_source": map[string]any{
+							"includes": alertSourceIncludes,
+						},
 					},
 				},
 			},
@@ -66,6 +75,9 @@ func adversaryBucketAggs() map[string]any {
 						"sort": []map[string]any{
 							{"@timestamp": map[string]any{"order": "desc"}},
 						},
+						"_source": map[string]any{
+							"includes": alertSourceIncludes,
+						},
 					},
 				},
 			},
@@ -93,8 +105,9 @@ func (u *adversaryUsecase) FetchAdversaryAlerts(
 	}
 
 	body := map[string]any{
-		"size":  0,
-		"query": common_models.FiltersToQuery(filters),
+		"size":    0,
+		"timeout": "30s",
+		"query":   common_models.FiltersToQuery(filters),
 		"aggs": map[string]any{
 			// Group by adversary.host when present — internally-identified
 			// attackers (compromised hosts, agents) carry a hostname.
diff --git a/frontend/src/features/adversaries/components/adversaries-sankey.tsx b/frontend/src/features/adversaries/components/adversaries-sankey.tsx
index bbe4e481f..15e2b77b3 100644
--- a/frontend/src/features/adversaries/components/adversaries-sankey.tsx
+++ b/frontend/src/features/adversaries/components/adversaries-sankey.tsx
@@ -167,8 +167,13 @@ export function AdversariesSankey({ data }: { data: AdversaryResponse[] }) {
     { key: 'adversaries.col.victims', color: COLUMN_COLOR.victim },
   ]
 
+
   return (
-    <div className="flex h-full w-full flex-col rounded-xl border border-border bg-card p-3">
+    <div
+      style={{
+        height:`${Math.min(Math.max(data.length,50)*1.7,300)}%`
+      }}
+      className={`flex  w-full flex-col rounded-xl border border-border bg-card p-3`}>
       <div className="grid grid-cols-3 gap-2 pb-2 text-xs font-medium">
         {headers.map((h, i) => (
           <div
diff --git a/frontend/src/features/alerts/lib/alert-meta.ts b/frontend/src/features/alerts/lib/alert-meta.ts
index d7225d427..95b03ede6 100644
--- a/frontend/src/features/alerts/lib/alert-meta.ts
+++ b/frontend/src/features/alerts/lib/alert-meta.ts
@@ -73,7 +73,7 @@ export const TS = '@timestamp'
 export const PAGE_SIZE_DEFAULT = 20
 
 export const SELECT_CLS =
-  'h-9 cursor-pointer rounded-md border border-input bg-background/40 px-2 text-sm transition-colors focus-visible:border-ring focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring'
+  'h-9 cursor-pointer rounded-md border border-input bg-popover px-2 text-sm text-popover-foreground transition-colors focus-visible:border-ring focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring'
 
 export function relativeTime(iso?: string) {
   if (!iso) return '—'