Botnet Filtering - Static Database
You can manually enter domain names or IP addresses (host or subnet) that you want to tag as bad names in a blacklist. Static blacklist entries are always designated with a Very High threat level.
Threat levels:
1. very-low
2. low
3. moderate
4. high
5. very-high

Command to drop blacklisted traffic:
dynamic-filter drop blacklist [interface name] [action-classify-list subset_access_list] [threat-level {eq level | range min max}]

Command to treat greylisted traffic as blacklisted traffic for dropping purposes:
dynamic-filter ambiguous-is-black
- If you do not enable this command, greylisted traffic will not be dropped.
• Ambiguous addresses (greylist)—These addresses are associated with multiple domain names, but not all of these domain names are on the blacklist. These addresses are on the greylist .

Example configuration form real ASA:
dynamic-filter drop blacklist interface outside
dynamic-filter ambiguous-is-black

Supported features:
• Supported in single and multiple context mode.

• Supported in routed and transparent firewall mode.

• Does NOT support replication of the DNS reverse lookup cache, DNS host cache, or the dynamic database in Stateful Failover.

• Does NOT support IPv6.

• TCP DNS traffic is NOT supported.

• You can add up to 1000 blacklist entries and 1000 whitelist entries in the static database.

• The packet tracer is NOT supported.

Defaults:
Botnet Traffic Filter is disabled by default, as is use of the dynamic database.
For DNS inspection, which is enabled by default, Botnet Traffic Filter snooping is disabled by default.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/protect_botnet.html

Licensing requirements:
• Botnet Traffic Filter License.
• Strong Encryption (3DES/AES) License to download the dynamic database.

Be sure to set up a DNS server for the ASA so that it can access the Cisco update server URL. In multiple context mode, the system downloads the database for all contexts using the admin context interface; be sure to set up a DNS server in the admin context.