Dynamic Lists are distributed list structures that can be used to store string elements, such as IP addresses, server names, or usernames. You can use these lists within a Correlation rule for a quick lookup to see whether an incoming event includes an element from the Dynamic List. Dynamic lists are also the only way to share state between multiple Correlation rules, so they are useful when co-ordination between different rules or the same rule at different times is needed.
Some examples of Dynamic Lists include:
Terminated user lists
Suspicious user watchlist
Privileged user watchlist
Authorized ports and services list
Authorized server list
NOTE:You must have the Manage Correlation Engine and Rules permission to create and manage Dynamic Lists.