Coverity Usage Log Analyzer

A Python script that analyzes log files to detect suspicious access patterns by identifying WebAccessEvent entries with URL="/token" that are not immediately preceded by a LogInEvent entry.

Overview

This python script helps identify potential indicators of compromise in Coverity usageLog files which indicate the potential for exploitation.

Features

• 🔍 Automated Log Analysis: Scans entire directories of log files
• 🚨 Suspicious Pattern Detection: Identifies token API endpoint access without preceding login events
• 📊 Detailed Reporting: Provides comprehensive analysis summaries
• 💾 JSON Export: Exports findings to structured JSON format
• 📁 Flexible File Support: Recognizes multiple log file formats and naming patterns produced by Coverity

Installation

Prerequisites

• Python 3.6 or higher
• No external dependencies required (uses only standard library)
• Note: this script should execute as intended regardless of operating system

Setup

1. Clone or download the script:

wget https://path/to/cov_uLog_analyzer.py
# or
git clone <repository-url>

2. Make the script executable:

chmod +x cov_uLog_analyzer.py

Usage

How to obtain Coverity Usage Logs

1. As an administrative user, log into Coverity.
2. In the upper-right next to your name, select the "Help" menu. Note: if you do not see the "Help" menu, you likely have incorrect privileges.
3. In the "Help" menu, select "System Diagnostics."
4. In the newly opened tab, select "Logs" from the lefthand menu.
5. Within the list of logs that appear, locate the row containing "usageLog.log."
6. Select "Download..." for the row containing "usageLog.log."
7. In the window that pops up, enter "30" into the text field and select "Download."
8. Wait for the download to complete and extract into a location of your choosing for analysis by the script.

Interactive Mode

Run the script without arguments to enter interactive mode:

python3 cov_uLog_analyzer.py

The script will prompt you for the directory path containing your log files.

Command Line Mode

Provide the log directory path as an argument:

python3 cov_uLog_analyzer.py /path/to/log/directory

Example Usage

# Analyze logs in the current directory
python3 cov_uLog_analyzer.py .

# Analyze logs in a specific directory
python3 cov_uLog_analyzer.py /var/log/application

# Analyze logs in a relative path
python3 cov_uLog_analyzer.py ./logs

Supported Log Formats

The analyzer recognizes log files with the following patterns:

• Extensions: .log, .txt, .json
• Naming patterns: Files starting with "log"
• Dated logs: Files matching pattern *.log.YYYY-MM-DD

Expected Log Entry Format

Log entries should be in JSON format with the following structure:

{
  "@type": "WebAccessEvent",
  "timestamp": "2026-02-11T10:30:45.123Z",
  "url": "/token",
  "userId": "user123",
  "remoteHost": "192.168.1.100"
}

{
  "@type": "LogInEvent", 
  "timestamp": "2026-02-11T10:30:44.800Z",
  "userId": "user123",
  "remoteHost": "192.168.1.100"
}

Output

Console Output

The script provides real-time analysis feedback:

🔍 Token Access Log Analyzer
========================================

Analyzing 5 log files in '/var/log/app'...
============================================================

📁 Analyzing: app.log.2026-02-10
⚠️  Suspicious token access found in app.log.2026-02-10:1247
   Timestamp: 2026-02-10T14:23:15.456Z
   User ID: user789
   Remote Host: 10.0.1.50
   Previous entry type: WebAccessEvent

📁 Analyzing: app.log.2026-02-11

============================================================

📊 Analysis Summary:
   Files analyzed: 5
   Suspicious token access events: 1

🔍 Summary of suspicious entries:
   1. app.log.2026-02-10:1247 at 2026-02-10T14:23:15.456Z

JSON Export

When exporting results, a JSON file is created with detailed information:

[
  {
    "file": "/var/log/app/app.log.2026-02-10",
    "line_number": 1247,
    "entry": {
      "@type": "WebAccessEvent",
      "timestamp": "2026-02-10T14:23:15.456Z",
      "url": "/token",
      "userId": "user789",
      "remoteHost": "10.0.1.50"
    },
    "previous_entry": {
      "@type": "WebAccessEvent", 
      "timestamp": "2026-02-10T14:23:10.123Z",
      "url": "/api/data",
      "userId": "user789"
    },
    "timestamp": "2026-02-10T14:23:15.456Z"
  }
]

Detection Logic

The analyzer identifies suspicious token access using the following logic:

1. Scans each log file line by line
2. Parses JSON entries and tracks the sequence of events
3. Identifies token access events (WebAccessEvent with url="/token")
4. Checks preceding event to see if it was a LogInEvent
5. Flags as suspicious if no login event immediately precedes token access

Security Implications

Any identified occurrence likely indicates unauthorized access and should be investigated further by reviewing Coverity and other supplemental logs from other systems to correlate activity and determine if the behavior is incidental or potentially malicious.

Troubleshooting

Common Issues

1. No log files found

   • Verify the directory path is correct
   • Check that log files match supported naming patterns
   • Ensure you have read permissions on the directory

2. JSON parsing errors

   • Verify log entries are in valid JSON format
   • Check for malformed log entries (script will skip invalid lines)

3. Permission errors

   • Ensure you have read access to log files
   • Run with appropriate permissions if needed

Error Handling

The script includes robust error handling:

• Skips invalid JSON lines without stopping analysis
• Handles file permission issues gracefully
• Continues analysis even if individual files fail
• Uses UTF-8 encoding with error ignoring for compatibility

License

Black Duck is providing this Python Script for Customer's use under terms of Customer's license agreement with Black Duck. This Python Script is provided "AS-IS”, without any warranty of any kind. Black Duck disclaims all warranties, express, implied or statutory, with respect to such Script, including but not limited to the implied warranties of noninfringement, merchantability, and fitness for a particular purpose.

Support

For issues or questions:

• Review the troubleshooting section
• Check log file formats match expected structure
• Verify file permissions and paths
• Test with a small sample of known log files