My rules is to check for hits from the list, which the list might contains quite a huge data.
For example the rule is: ip.dst = $[list]
List: 1.1.1.1, 2.2.2.2,......, etc.
When I drill in to particular hits, the query should be: (ip.dst = 1.1.1.1, 2.2.2.2, ....... +2000 character).
But it end up to be: (ip.dst = 1.1.1.1, 2.2.2.2, ......., 56.56.56.56
It stops half way. And having issues of syntax error, which in this case is due to the "(".
if you are doing this query in RE, then you need to tag the IP's first using a feed, lists should not exceed about 100 entries). Create a feed from the list to tag the IP addresses in a metakey (I usually create a couple of custom metakeys for my customers, like "customer.info" and "customer.alert" (the "customer" part is usually the Company initials, or a Security team code like CIRC or SOC) and use the .info key for putting values in from rules tagging data for use in alerts of RE/ESA rules) so in your case, create an ip.dst feed to match the list of IP's and create a value in "customer.info" that relates to the rule, like "watchlist_ip", then your RE rule would be: customer.info = 'watchlist_ip'