Spyware site traffic audit?

Question

Since it appears that the Spyware Sites user-defined group is static, how is the built-in rule "Known Spyware Site Traffic" useful? I've seen another thread that mentions that enabling this rule actually slows LEM down significantly. Is there some way to make this group update dynamically with a "known bad" list?

FormerMember · Answer

We have a task/request to update the group - we've used third party sites to build the list, and have updated it periodically. Is static, and will only get updated when we provide updates on our end (or if you import/create a new group). Using it in Monitor can slow down the real-time view since the group is so large, and I believe it actually trips a cap in nDepth on the size of query because of the size of the group. We might need to split it into pieces or create a more limited group to help there.

No magic just yet, but that is the eventual hope.