Some watch list are created and maintained manually (e.g. Monitored subnet IPv4 address and subnet mask for Module 10011: Network Subnets Monitor), and some can be automatically loaded and updated via External Data Feeder for NFO (e.g. Known malicious hosts list for Module 10052: Host Reputation Monitor).