Hi, I would like to know to if there is way to append a reference list without getting the content of the list before?
I look at https://cloud.google.com/chronicle/docs/reference/reference-lists-api#updatereferencelist and the UpdateReferenceList seems to need list lines old and news before update the list.
Does chronicle thinking of creating some kind append to list without sending the whole list?
Best regards,
The API is (currently) replace-only, so you do need to get the current items first and append them (as you suspect).
That said, I've tried to make that a bit easier by providing some python client code that does the get+append behind the scenes. It is on GitHub for the Backstory API: https://github.com/chronicle/api-samples-python/blob/master/lists/append_to_list.py
...and there is also a v1alpha version of that for the new Chronicle REST API: https://github.com/chronicle/api-samples-python/blob/master/lists/v1alpha/patch_list.py
This blog describes the latter: https://www.googlecloudcommunity.com/gc/Community-Blog/Update-Reference-Lists-with-Python-and-the-new-Chronicle-REST/ba-p/717241
Hi DanDye, thanks you for the answer. I really appreciate it. I was playing with an old version api-sample-python. I need to update it.
Best regards,
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.