Hi everyone,
I'm working with Reference Lists in Google SecOps (Chronicle) and planning to use them to store IOCs (Indicators of Compromise) such as IPs, domains, hashes, and URLs for detection rules.
Before I start populating them at scale, I'd like to confirm a few things:
- What is the maximum number of entries a single Reference List can hold?
- Is there a size limit (in MB/KB) per Reference List, in addition to or instead of an entry count limit?
- Are the limits different based on the list type (e.g., String, Regex, CIDR)?
- Is there a limit on the total number of Reference Lists per tenant/instance?
- If I exceed the limit, what's the recommended approach — splitting IOCs across multiple lists, or another mechanism?
Any pointers to official documentation or real-world experience with large IOC lists would be greatly appreciated.
Thanks in advance!

