Subsearch allows you to specify a query to run and then use the results from that query in another query. Subsearch can be run by itself or with variable expansion. Variable expansion allows you to specify a list of pre-populated values and then use the results from that query in another query. Variable expansion can also be run independently of subsearch.
Note
Trellix Helix searches require computed short names for variables such as lists. Use the computed short name of a list when referencing it (for example, from rules).