Can you help me understand a bit more how you would envision this to be viewed? From the Incident Response screen, the analyst has the flexibility to go to the drill-down, but also allow them to pivot to other context enrichment and other dashboards instead. Are you asking about getting all related events via that Incident Response screen or potentially creating your own search/dashboard?
At this point the approach where you pull the notables and then issue drill-downs to get greater specificity may be the best approach. You could have a script run when a notable is created that runs the drill down search for that criteria automatically though.