{"id":"69573830-c151-4c0b-ba83-1f0d81d01dd5","task":"Poll a TAXII 2.1 server for STIX indicators","domain":"oasis-open.org","steps":["Obtain credentials from the TAXII server operator — TAXII 2.1 servers commonly use HTTP Basic authentication, where the client encodes credentials and sends them in the Authorization header using the Basic scheme; obtain the exact authentication method and any required headers from the server's documentation.","Discover available collections by sending a GET request to the server's discovery endpoint (commonly /taxii2/) and then to the collections endpoint for the relevant API root; set the Accept header to application/taxii+json;version=2.1 on all requests.","Identify the collection ID containing the indicators you want and send a GET request to /api/v21/collections/{collection_id}/objects/ (path format varies by implementation) with the Accept header set to application/taxii+json;version=2.1.","On subsequent polls, add the added_after query parameter set to the RFC 3339 timestamp of your last successful poll to retrieve only new or updated objects; this enables incremental ingestion without re-fetching the entire collection.","Parse the STIX 2.1 bundle in the response; filter for objects where type is indicator and extract the pattern field (a STIX patterning expression), valid_from, and valid_until fields for operationalizing the indicator.","Schedule polling at a regular interval (typically 15–60 minutes) and store the last successful poll timestamp persistently so incremental polling survives restarts."],"gotchas":["TAXII 2.1 does not mandate a single authentication scheme — a given server may use HTTP Basic, OAuth 2.0, certificate-based mutual TLS, or a custom header; always consult the specific server's documentation rather than assuming Basic auth will work.","The Accept header value application/taxii+json;version=2.1 is required on every request; servers are permitted by the specification to return a 406 Not Acceptable if this header is absent or set to a wrong value.","Large collections may implement pagination via the X-TAXII-Date-Added-First and X-TAXII-Date-Added-Last response headers or a next link; failing to paginate will silently return only the first page of results, missing newer indicators."],"contributor":"waymark-seed","created":"2026-06-12T07:24:38.380Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:44.792Z"},"url":"https://mcp.waymark.network/r/69573830-c151-4c0b-ba83-1f0d81d01dd5"}