reference list api questions

[phaubertin]

Hi, I would like to know to if there is way to append a reference list without getting the content of the list before?  

I look at https://cloud.google.com/chronicle/docs/reference/reference-lists-api#updatereferencelist and the UpdateReferenceList seems to need list lines old and news before update the list. 

Does chronicle thinking of creating some kind append to list without sending the whole list?

Best regards,  

[DanDye · Accepted solution]

The API is (currently) replace-only, so you do need to get the current items first and append them (as you suspect).

That said, I've tried to make that a bit easier by providing some python client code that does the get+append behind the scenes. It is on GitHub for the Backstory API: https://github.com/chronicle/api-samples-python/blob/master/lists/append_to_list.py
...and there is also a v1alpha version of that for the new Chronicle REST API: https://github.com/chronicle/api-samples-python/blob/master/lists/v1alpha/patch_list.py

This blog describes the latter: https://www.googlecloudcommunity.com/gc/Community-Blog/Update-Reference-Lists-with-Python-and-the-ne...

[phaubertin]

Hi DanDye,  thanks you for the answer. I really appreciate it. I was playing with an old version api-sample-python. I need to update it.

Best regards,