Does Action = "GoogleChronicle-Add Values To Reference List" overwrites the values in reference list

[skadav]

Hello All,

Just a question: Does Action = "GoogleChronicle-Add Values To Reference List" overwrites the values in reference list?

Thanks,
Suraj Kadav

[vanitharaj1208]

no it doesnot overwrites

make sure the Reference list name is valid and exists and this action basically adds values to the reference List in google chronicle.

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to...

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to_reference_list

[skadav]

Thank you.

Actually the action is working perfectly fine for me. but what I can see, every time when reference list gets updated, its count getting changed.

for example: I ran action to update reference list 1hr back, the count is 7500.
then I ran update reference list action now, the value is 6000.

So I am curious to know, if this action overwrites the reference list values. I can find any clarification on this on link - >   https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to...

but as per Chris Martin (@thatsiemguy) blog its getting overwritten -> https://medium.com/@thatsiemguy/automating-chronicle-siem-reference-list-using-chronicle-soar-78f2e7....

So not getting concrete answer. but as per behavior it seems it overwrites.

[vanitharaj1208]

question asked was about action add to reference list and in the blog he is using update reference list via API method

[vanitharaj1208]

i have also implemented this in my lab by following this blog and this works perfectly fine 

[vanitharaj1208]

 The Update Reference List method acts more like a Create Reference method as it does not append values to the existing Reference List but rather overwrites the entire existing contents. You need to be careful to not inadvertently overwrite an existing Reference List when using this API method.

it overwrites existing reference list when using API method according to the Blog

[skadav]

@vanitharaj1208  Thank you for clarifying my doubt.