From Steve:

"Create flowbits based on anything found in a log. For instance, pull a username from a log and create a flowbit named the same as the username (user bob would have a flowbit called "bob"). Idea is to be able to track the DC a user normally logs into and alert when they log into a different DC."