I know report engine rule has list option or watchlist option to use in report engine where statement. What is the name called in ESA 10.4? Does it exists?
How large is the list that you want to use?
You could look into using a Feed on the Decoder to generate a piece of Meta that you reference in your ESA rules.
Or you could look into declaring an array variable within the EPL itself:
create variable string mylist =
SELECT * FROM Event(user_dst IS ANY(mylist));
Retrieving data ...