Skip to content
LogoLogScale DocumentationFull Library Knowledge Base Release Notes Integrations Query Examples Training API GraphQL API Contacting Support
help

Versions of this Page

    • LogScale System Repository Schema Guide
    • The humio Repository
      • Query data in the humio Repository
    • The humio-activity Repository
        • Action
        • Action/Action
        • AggregateAlert/Alert
        • AggregateAlert/Query
        • Alert/Action
        • Alert/Alert
        • Alert/Query
        • Fdr/Entity
        • Fdr/Ingest
        • FilterAlert/Alert
        • FilterAlert/Query
        • PermissionAssignment/groupAssignments
        • PermissionAssignment/numberOfGroups
        • PermissionAssignment/numberOfUsers
        • PermissionAssignment/userAssignments
        • PermissionAssignment/userPermissionCounts
        • Query
        • Request
        • ScheduledSearch/Action
        • ScheduledSearch/Query
        • ScheduledSearch/Schedule
        • ScheduledSearch/ScheduledSearch
        • SystemPrivilege/ChangeSystemPermission
        • SystemPrivilege/ManageOrganizations
      • Alert, Scheduled Search, and Scheduled Report Errors and Resolutions
    • The humio-audit Repository
      • Common humio-audit Structures
        • humio-audit Actor Structure
          • Query Actor Data
        • humio-audit Query Structure
      • humio-audit Event types
      • Examples of queries for humio-audit
    • The humio-fleet Repository
    • The humio-measurements Repository
    • The humio-metrics Repository
      • Node-Level Metrics
      • Object-Level Metrics
      • Example queries
    • The humio-usage Repository
      • humio-organization-usage View
    • The humio-trigger-execution-info Repository
Falcon LogScale Documentation
/ LogScale System Repository Schema Guide
/ The humio-audit Repository
/ humio-audit Event types

Audit Log Event bucket-storage.update

Bucket storage configuration has been updated

This audit log type records operations for the following features:

  • Storage Architecture

Field TypeTypeValueAvailabilityDescription
actorActorType   Actor, as defined in humio-audit Actor Structure
sensitiveBoolean   Whether the audited event is marked sensitive
targetBucketId1String   Target bucket ID
targetBucketId2Option[String]   Target bucket ID
timestampZonedDateTime   Timestamp of the audited event
Support
  • Twitter
  • LinkedIn
  • Youtube

© 2025 CrowdStrike All other marks contained herein are the property of their respective owners.

  • Other articles on this topic

    • Bucket Storage
    • Storage Architecture
  • Related Configuration Variables

    • AZURE_STORAGE_BUCKET (Self-Hosted)
    • AZURE_STORAGE_CONCURRENCY (Self-Hosted)
    • AZURE_STORAGE_ENCRYPTION_KEY (Self-Hosted)
    • AZURE_STORAGE_ENDPOINT_BASE (Self-Hosted)
    • AZURE_STORAGE_OBJECT_KEY_PREFIX (Self-Hosted)
    • AZURE_STORAGE_PREFERRED_COPY_SOURCE (Self-Hosted)
    • AZURE_STORAGE_RESPONSE_TIMEOUT_SECONDS (Self-Hosted)
    • AZURE_STORAGE_USE_HTTP_PROXY (Self-Hosted)
    • BUCKET_STORAGE_IGNORE_ETAG_UPLOAD (Self-Hosted)
    • BUCKET_STORAGE_MULTIPLE_ENDPOINTS (Self-Hosted)
    • BUCKET_STORAGE_SSE_COMPATIBLE (Self-Hosted)
    • GCP_STORAGE_ACCOUNT_JSON_FILE (Self-Hosted)
    • GCP_STORAGE_CONCURRENCY (Self-Hosted)
    • GCP_STORAGE_ENDPOINT_BASE (Self-Hosted)
    • GCP_STORAGE_PREFERRED_COPY_SOURCE (Self-Hosted)
    • MAX_BUCKET_POINTS (Self-Hosted)
    • S3_ARCHIVING_ACCESSKEY (Self-Hosted)
    • S3_ARCHIVING_ENDPOINT_BASE (Self-Hosted)
    • S3_ARCHIVING_REQUIRE_ROLE (Self-Hosted)
    • S3_ARCHIVING_SECRETKEY (Self-Hosted)
    • S3_ARCHIVING_USE_HTTP_PROXY (Self-Hosted)
    • S3_ARCHIVING_WORKERCOUNT (Self-Hosted)
    • S3_EXPORT_USE_HTTP_PROXY (Self-Hosted)
    • S3_NETTY_CLIENT (Self-Hosted)
    • S3_NETTY_CONNECTING_TIMEOUT_SECONDS (Self-Hosted)
    • S3_NETTY_CONNECTION_ACQUISITION_TIMEOUT_SECONDS (Self-Hosted)
    • S3_NETTY_CONNECTION_IDLE_TIMEOUT_SECONDS (Self-Hosted)
    • S3_NETTY_CONNECTION_TTL_SECONDS (Self-Hosted)
    • S3_NETTY_TCP_KEEP_ALIVE (Self-Hosted)
    • S3_NETTY_THREAD_POOL_MAX_SIZE (Self-Hosted)
    • S3_RECOVER_FROM_KMS_KEY_ARN (Self-Hosted)
    • S3_STORAGE_2_KMS_KEY_ARN (Self-Hosted)
    • S3_STORAGE_ACCESSKEY (Self-Hosted)
    • S3_STORAGE_BUCKET (Self-Hosted)
    • S3_STORAGE_CONCURRENCY (Self-Hosted)
    • S3_STORAGE_DISABLE_UPLOAD_DUPLICATE_CHECK (Self-Hosted)
    • S3_STORAGE_ENCRYPTION_KEY (Self-Hosted)
    • S3_STORAGE_ENDPOINT_BASE (Self-Hosted)
    • S3_STORAGE_KMS_KEY_ARN (Self-Hosted)
    • S3_STORAGE_OBJECT_KEY_PREFIX (Self-Hosted)
    • S3_STORAGE_PREFERRED_COPY_SOURCE (Self-Hosted)
    • S3_STORAGE_REGION (Self-Hosted)
    • S3_STORAGE_SECRETKEY (Self-Hosted)
    • S3_STORAGE_USE_HTTP_PROXY (Self-Hosted)
  • Architecture

    • Ingestion: Storage Phase
  • Related KB Articles

    • FAQ: Why does my Bucket Storage Size indicate larger value than LogScale UI
  • Security Audit Entries

    • Audit Log Event bucket.storage.target.delete
    • Audit Log Event bucket.storage.target.update

Enter search term