Skip to main content
GET
/
api
/
taxii2
/
api
/
collections
/
{collectionId}
/
objects
/
Pull recent indicators
curl -H "Authorization: Bearer sk_live_..." \
  -H "Accept: application/taxii+json;version=2.1" \
  "https://socdefenders.ai/api/taxii2/api/collections/soc-defenders-network/objects/?added_after=2026-05-16T00:00:00Z&limit=500"
{
  "type": "bundle",
  "id": "bundle--12345678-1234-1234-1234-123456789abc",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--f8e75d96-8e4c-4b1a-9e3d-4f8a7b6c5d3e",
      "created": "2024-01-01T00:00:00.000Z",
      "modified": "2026-05-17T10:30:00.000Z",
      "name": "SOC Defenders",
      "identity_class": "organization"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00000000-0000-4000-8000-000000000001",
      "created": "2026-05-16T08:21:30Z",
      "modified": "2026-05-16T08:21:30Z",
      "created_by_ref": "identity--f8e75d96-8e4c-4b1a-9e3d-4f8a7b6c5d3e",
      "object_marking_refs": [
        "marking-definition--bab4a63c-aed9-4cf5-a766-dfca5abac2bb"
      ],
      "name": "Malicious Domain - c2.example.com",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c2.example.com']",
      "pattern_type": "stix",
      "valid_from": "2026-05-16T08:21:30Z",
      "confidence": 85,
      "labels": [
        "c2",
        "botnet"
      ]
    }
  ]
}

Authorizations

​
X-API-Key
string
header
required

API key in X-API-Key header

Path Parameters

​
collectionId
string
required

Collection ID from the list endpoint (e.g. soc-defenders-all, soc-defenders-network, soc-defenders-hashes).

Example:

"soc-defenders-network"

Query Parameters

​
added_after
string<date-time>

Return only objects added to the collection after this timestamp. Canonical delta-poll mechanism — save the response's X-TAXII-Date-Added-Last header value and pass it back here on the next request.

Example:

"2026-05-16T00:00:00Z"

​
limit
integer
default:100

Max objects per response (max 1000). For deep pulls, walk forward via added_after rather than skipping.

Required range: x <= 1000
Example:

500

​
type
string

Filter by STIX object type. indicator is the most common — narrows the bundle to just IOC indicators (no identity/marking-definition objects).

Example:

"indicator"

Response

STIX 2.1 bundle of objects in the collection. Use X-TAXII-Date-Added-Last for delta-poll continuation.

​
type
enum<string>
Available options:
bundle
​
id
string
Pattern: ^bundle--[0-9a-f-]+$
​
objects
object[]