[httpjson-pagination] ti_cybersixgill threat stream can paginate indefinitely on non-advancing TAXII header

## Findings

### 1. Unconditional `added_after` pagination can loop forever when the TAXII header does not advance

**Severity:** High
**Location:** `packages/ti_cybersixgill/data_stream/threat/agent/stream/httpjson.yml.hbs#L40-L44`

**Evidence:**
```yaml
response.pagination:
- set:
target: url.params.added_after
value: '[[ .last_response.header.Get "X-TAXII-Date-Added-Last" ]]'
fail_on_template_error: true
```

The pagination step always sets `url.params.added_after` from `X-TAXII-Date-Added-Last`, with no guard for forward progress and no termination condition tied to body emptiness or token change.

**Runtime failure trace:**
1. Initial request uses `added_after=T0` (from cursor/default).
2. API legitimately returns `200` with `objects: []` and header `X-TAXII-Date-Added-Last: T0` (same value).
3. Pagination sets `added_after` to `T0` again.
4. Next request is identical to the previous request.
5. Steps 2–4 repeat indefinitely inside the pagination loop, repeatedly hitting the same page.

**Why this is wrong:**
Pagination should terminate when there is no next page / no progress token advancement. Here, the chain continues whenever the header is present, even if it is unchanged.

**Why it matters:**
This can hammer the TAXII endpoint in a tight loop, consume API quota, and stall collection progress.

**Suggested fix:**
Only paginate when there is forward progress, e.g. set `url.params.added_after` **only if** the returned header exists and differs from the previous `added_after` (or gate on an explicit API `more` signal). If unchanged/missing, leave the value empty to terminate pagination.

## Investigated and found correct

1. `packages/ti_eset/data_stream/url/agent/stream/httpjson.yml.hbs#L43-L49` gates pagination on `body.more`, so empty/terminal pages stop correctly.
2. `packages/atlassian_bitbucket/data_stream/audit/agent/stream/httpjson.yml.hbs` uses `pagingInfo.nextPageLink`; lack of next link terminates.
3. `packages/github/data_stream/issues/agent/stream/httpjson.yml.hbs` follows RFC5988 `Link rel=next`; absence of `next` terminates.

## Notes

I also evaluated candidate cursor-drift findings (e.g., numeric cursor interpolation) but did not include them here due to prior tracking in `/tmp/previous-findings.json` and stricter confidence filtering for this run.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 32 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - issue:#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18208 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18206 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18204 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18202 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18201 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18200 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18197 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18193 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#50021 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18186 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18181 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18180 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18179 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18178 (`list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - ... and 16 more items
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Sweeper: httpjson and CEL Pagination and Cursor Integrity](https://github.com/elastic/integrations/actions/runs/23941258508)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 10, 2026, 9:33 AM UTC