fix(harfanglab): retry transient API errors (1.7.3)

HarfangLab answers a 500 now and then on a call that passes when sent
again. Each script's request() now retries up to three times (1, 2, 4 s):
GET on 429/500/502/503/504, writes only on 429/502/503 so an isolation,
a kill or a job is never sent twice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

integrations/harfanglab/scripts/add_ioc_to_source.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/alert_comment.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/alert_details.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/alert_history.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/alert_tag.py

@@ -1,16 +1,35 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 
 def csv(v):
     return [x.strip() for x in str(v or "").split(",") if x.strip()]
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/api_call.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/assign_policy_to_agent.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/av_scan.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def csv(v):

integrations/harfanglab/scripts/change_security_event_status.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/deisolate_endpoint.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/deisolate_from_threat.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/delete_file.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/delete_ioc_from_source.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/delete_scheduled_task.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/delete_service.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/dump_process.py

@@ -1,4 +1,4 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 FIELD_TYPES = {
     "name": 0, "path": 1, "username": 3, "commandline": 4,
@@ -8,12 +8,31 @@ FIELD_TYPES = {
 OPERATORS = {"eq": 0, "not_eq": 1, "contains": 2, "not_contains": 3}
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/endpoint_count.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/endpoint_search.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/get_alerts.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/get_endpoint_info.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/get_security_events.py

@@ -1,13 +1,32 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 SEVERITIES = ["low", "medium", "high", "critical"]
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers):
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=90) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/get_threat.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/get_threats.py

@@ -1,13 +1,32 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 SEVERITIES = ["low", "medium", "high", "critical"]
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers):
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=90) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/hunt_search_hash.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/hunt_search_runned_process_hash.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/hunt_search_running_process_hash.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/isolate_endpoint.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/isolate_from_threat.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/job_artifact_all.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_downloadfile.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_evtx.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_filesystem.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_hives.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_logs.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_mft.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_artifact_ramdump.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_cancel.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/job_driverlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_info.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_ioc.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_networkconnectionlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_networksharelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_persistencelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_pipelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_prefetchlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_processlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_relaunch.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/job_runkeylist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_scheduledtasklist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_servicelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_sessionlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_startuplist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/job_wmilist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/kill_process.py

@@ -1,4 +1,4 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 FIELD_TYPES = {
     "name": 0, "path": 1, "username": 3, "commandline": 4,
@@ -8,12 +8,31 @@ FIELD_TYPES = {
 OPERATORS = {"eq": 0, "not_eq": 1, "contains": 2, "not_contains": 3}
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/quarantine_file.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/quarantine_request_upload.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/quarantine_search.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_all.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_downloadfile.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_evtx.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_filesystem.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_hives.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_logs.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_mft.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_artifact_ramdump.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_driverlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_ioc.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_networkconnectionlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_networksharelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_persistencelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_pipelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_prefetchlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_processlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_runkeylist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_scheduledtasklist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_servicelist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_sessionlist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_startuplist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/result_wmilist.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_authentication_linux.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_authentication_macos.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_authentication_users.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_authentication_windows.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_binary.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_dns.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_eventlog.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_network.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_process_graph.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/telemetry_processes.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/test_connection.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/threat_comment.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/threat_history.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/threat_level.py

@@ -1,16 +1,35 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 
 def csv(v):
     return [x.strip() for x in str(v or "").split(",") if x.strip()]
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/threat_note_set.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/threat_security_events.py

@@ -1,14 +1,33 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 PAGE = 500
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):

integrations/harfanglab/scripts/threat_status.py

@@ -1,16 +1,35 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 
 def csv(v):
     return [x.strip() for x in str(v or "").split(",") if x.strip()]
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/unquarantine_file.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/wait_for_job.py

@@ -1,12 +1,31 @@
 import json, os, sys, time, urllib.request, urllib.parse, urllib.error
 
 
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
+
+
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def main():

integrations/harfanglab/scripts/whitelist_add.py

@@ -1,12 +1,31 @@
-import json, os, sys, urllib.request, urllib.parse, urllib.error
+import json, os, sys, time, urllib.request, urllib.parse, urllib.error
+
+
+RETRIES = 3
+
+
+def retryable(method, status):
+    # HarfangLab answers a 500 now and then on a call that passes when sent again.
+    # A read is safe to resend; a write only on an answer that says the action was
+    # not run (rate limit, gateway down), so an isolation or a job is never sent twice.
+    if status in (429, 502, 503):
+        return True
+    return method == "GET" and status in (500, 504)
 
 
 def request(method, url, headers, body=None):
     data = json.dumps(body).encode("utf-8") if body is not None else None
+    for attempt in range(RETRIES + 1):
         req = urllib.request.Request(url, data=data, headers=headers, method=method)
+        try:
             with urllib.request.urlopen(req, timeout=60) as resp:
                 raw = resp.read()
                 return json.loads(raw) if raw else {}
+        except urllib.error.HTTPError as e:
+            if attempt == RETRIES or not retryable(method, e.code):
+                raise
+            e.close()
+            time.sleep(2 ** attempt)
 
 
 def qs(params):