Get Objects

Returns a STIX 2.1 bundle of threat indicators from the specified collection.

Incremental polling

Use added_after to fetch only indicators added since your last poll:

GET /taxii2/collections/ics-feed/objects/?added_after=2026-07-11T00:00:00Z&limit=100

Pagination uses the next cursor returned in the bundle.

Header	Description
`X-TAXII-Date-Added-First`	Timestamp of earliest object in the page
`X-TAXII-Date-Added-Last`	Timestamp of latest object in the page

Use global-feed for the global enriched feed.