There are several ways an element can be removed from a dynamic list:
A user can remove it manually
The element can be removed by a Correlation rule action
The transient element life span can expire
If the maximum number of elements for a dynamic list is reached, elements are removed from the list to keep the list at or below the maximum list size. The transient elements are removed (from oldest to newest) before any persistent elements are removed.
For trademark and copyright information, see Legal Notices.