Dynamic Lists

Dynamic Lists can be used within correlation rules to specify a set of strings, such as IP addresses, server names, or usernames. A Dynamic List can be built using the text values for any event metatag, and these values may be added to the list manually by an administrator or automatically when a correlation rule fires

Regardless of how the values were added, they may be Persistent (active until manually removed or until the maximum list size is reached) or Transient (active only for a specified timeframe after being added to the list, otherwise known as the Time to Live). The Time to Live can range from 60 seconds to 90 days.

You can use Dynamic List to:

NOTE: If the Time to Live period is updated on an active Dynamic List, the change is not retroactive to elements already on the list. Elements that have already been added to the dynamic list will retain their original Time to Live.