Get a TAXII collection

{"id", "title", "description", "can_read": true, "can_write": false, "media_types": ["application/stix+json;version=2.1"]}. On malicious-domains, malicious-ips, malicious-subdomains and c2-indicators, three custom properties from the corpus walk (every 12 h): x_ismalicious_score_histogram (indicator counts per ten-point score band, "0-9" … "90-100" — the same score min_score/max_score filter on, so "60-69" is what min_score=60&max_score=69 would page through), x_ismalicious_total and x_ismalicious_computed_at (RFC 3339). Absent until the first walk after deploy, and on URL/hash collections, which the walk does not cover