Does Action = "GoogleChronicle-Add Values To Reference List" overwrites the values in reference list

no it doesnot overwrites

make sure the Reference list name is valid and exists and this action basically adds values to the reference List in google chronicle.

https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to_reference_list

Thank you.

Actually the action is working perfectly fine for me. but what I can see, every time when reference list gets updated, its count getting changed.

for example: I ran action to update reference list 1hr back, the count is 7500.
then I ran update reference list action now, the value is 6000.

So I am curious to know, if this action overwrites the reference list values. I can find any clarification on this on link - >   https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to_reference_list

but as per Chris Martin (@thatsiemguy) blog its getting overwritten -> https://medium.com/@thatsiemguy/automating-chronicle-siem-reference-list-using-chronicle-soar-78f2e77c47dd#:~:text=The%20Update%20Reference%20List%20method%20acts%20more%20like%20a%20Create%20Reference%20method%20as%20it%20does%20not%20append%20values%20to%20the%20existing%20Reference%20List%20but%20rather%20overwrites%20the%20entire%20existing%20contents.%20You%20need%20to%20be%20careful%20to%20not%20inadvertently%20overwrite%20an%20existing%20Reference%20List%20when%20using%20this%20API%20method.

So not getting concrete answer. but as per behavior it seems it overwrites.

Thank you.

Actually the action is working perfectly fine for me. but what I can see, every time when reference list gets updated, its count getting changed.

for example: I ran action to update reference list 1hr back, the count is 7500.
then I ran update reference list action now, the value is 6000.

So I am curious to know, if this action overwrites the reference list values. I can find any clarification on this on link - >   https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#add_values_to_reference_list

but as per Chris Martin (@thatsiemguy) blog its getting overwritten -> https://medium.com/@thatsiemguy/automating-chronicle-siem-reference-list-using-chronicle-soar-78f2e77c47dd#:~:text=The%20Update%20Reference%20List%20method%20acts%20more%20like%20a%20Create%20Reference%20method%20as%20it%20does%20not%20append%20values%20to%20the%20existing%20Reference%20List%20but%20rather%20overwrites%20the%20entire%20existing%20contents.%20You%20need%20to%20be%20careful%20to%20not%20inadvertently%20overwrite%20an%20existing%20Reference%20List%20when%20using%20this%20API%20method.

So not getting concrete answer. but as per behavior it seems it overwrites.

 The Update Reference List method acts more like a Create Reference method as it does not append values to the existing Reference List but rather overwrites the entire existing contents. You need to be careful to not inadvertently overwrite an existing Reference List when using this API method.

it overwrites existing reference list when using API method according to the Blog