Realm.Security Documentation

Appearance

NetSuite Audit Logs ​

Realm Security integrates with NetSuite to collect audit log data (system notes tracking record changes, logins, and configuration changes) for security monitoring and compliance.

Realm connects to NetSuite using OAuth 2.0 machine-to-machine (M2M) authentication — a certificate-based flow that doesn't require a NetSuite user to log in interactively. Setup involves creating an integration record in NetSuite, generating a certificate, and mapping that certificate to a role before providing the resulting credentials to Realm.

Prerequisites ​

  • Administrative access to your NetSuite account, or a role with the OAuth 2.0 Authorized Applications Management permission.
  • OpenSSL installed on your machine (or an equivalent tool for generating an RSA or EC key pair and self-signed certificate).
  • Realm Collector is set up and running, or access to the Realm console to configure a NetSuite source directly, depending on your deployment.

Overview ​

  1. NetSuite: Enable the OAuth 2.0 feature
  2. NetSuite: Create an integration record
  3. NetSuite: Generate a certificate and private key
  4. NetSuite: Map the certificate to a role (OAuth 2.0 Client Credentials M2M Setup)
  5. NetSuite: Confirm the role has the required permissions
  6. Realm Console: Configure the NetSuite Input Feed

1. NetSuite: Enable the OAuth 2.0 Feature ​

  1. Log in to NetSuite as an Administrator.
  2. Navigate to Setup > Company > Enable Features.
  3. Select the SuiteCloud subtab.
  4. Check the box to enable OAuth 2.0.
  5. Click Save.

2. NetSuite: Create an Integration Record ​

  1. Navigate to Setup > Integration > Manage Integrations > New.

  2. Give the integration a name (e.g. Realm Security).

  3. Under Authentication, check Client Credentials (Machine to Machine) Grant.

  4. Set State to Enabled.

  5. Click Save.

    Important: After saving, NetSuite displays a Client ID. Store this value immediately — it cannot be retrieved again after you leave this page. You will need it when configuring the NetSuite Input Feed in the Realm console.

3. NetSuite: Generate a Certificate and Private Key ​

Realm authenticates using a certificate rather than a shared secret. Generate a key pair and self-signed certificate using OpenSSL:

openssl req -x509 -newkey rsa:4096 -sha256 -days 730 -nodes \
  -keyout realm_private_key.pem -out realm_certificate.pem

This produces two files:

  • realm_certificate.pem — the public certificate. This gets uploaded to NetSuite in the next step.
  • realm_private_key.pem — the private key. This is never uploaded to NetSuite — store it securely, as it will be provided directly to Realm when configuring the input feed.

Note: NetSuite also supports EC keys (ES256/ES384/ES512) as an alternative to RSA (PS256/PS384/PS512). The command above generates an RSA key; use an equivalent openssl ecparam command if you prefer an EC key instead.

4. NetSuite: Map the Certificate to a Role ​

Uploading a certificate isn't enough on its own — NetSuite requires an explicit mapping between the integration record, a role, and the certificate before the flow will work.

  1. Navigate to Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials (M2M) Setup.

  2. Click Create New.

  3. In the popup window:

    Entity: Select the user this integration should run as. Realm recommends a dedicated integration user rather than a personal account. Role: Select the role assigned to that user. This role must be created as an Administrator role — see Step 5 below for why. Application: Select the integration record you created in Step 2. This option is only available if Client Credentials (Machine to Machine) Grant was checked on that record. Certificate: Upload realm_certificate.pem from Step 3.

  4. Click Save.

    Important: After saving, the mapping appears in the list on this page along with a generated Certificate ID. Store this value — you will need it, along with the Client ID and your private key, when configuring the NetSuite Input Feed in the Realm console.

Note: This mapping is specific to the NetSuite account you configured it in — it does not carry over to sandbox or Release Preview accounts, and is cleared whenever a sandbox account is refreshed. If you're testing in a sandbox first, you'll need to repeat this step again for production.

5. NetSuite: Confirm Role Permissions ​

Important: The role selected in Step 4 must be created as an Administrator role, not a limited or least-privilege custom role. NetSuite scopes System Note visibility to what the assigned role can see — a role that is scoped to a specific user or a restricted set of records will authenticate successfully but return no data when Realm queries System Notes. Create the role by copying the standard Administrator role rather than building a narrower custom role.

The role selected in Step 4 needs, at minimum:

  • Administrator-level access, so System Notes are visible across all record types you want audited — this is the data Realm queries for audit log collection.
  • REST Web Services permission enabled, so the integration can call NetSuite's REST / SuiteQL endpoints.
  • Log in using OAuth 2.0 Access Tokens permission enabled, so the role can authenticate via the OAuth 2.0 client credentials (M2M) flow.

To add the Log in using OAuth 2.0 Access Tokens permission to the role:

  1. Navigate to Setup > Users/Roles > Manage Roles.
  2. Click Edit next to the role selected in Step 4.
  3. Go to the Permissions subtab, then the Setup sub-subtab.
  4. From the dropdown, select Log in using OAuth 2.0 Access Tokens and click Add.
  5. Click Save.

If you're unsure which permissions your selected role already grants, review the role under Setup > Users/Roles > Manage Roles. Do not scope this role down to a narrower custom role — System Notes will not be returned for a role that isn't Administrator-level.

6. Realm Console: Configure the NetSuite Input Feed ​

  1. Login to the Realm console.
  2. Go to Sources > Add and add a new Source.

    Name: NetSuiteDescription: NetSuite audit logsFormat: NetSuite Audit Logs

  3. Provide the following values, gathered from the steps above:

    Account ID: Your NetSuite account ID (visible in your NetSuite login URL, e.g. https://<accountID>.app.netsuite.com). Client ID: From Step 2. Certificate ID: From Step 4. Private Key: The contents of realm_private_key.pem from Step 3.

Realm will use these credentials to sign a JWT, exchange it for an access token, and begin polling NetSuite's SystemNote data on your behalf. No further action is required in NetSuite unless your certificate expires or is revoked — see the note below.

Note on certificate expiration: the certificate generated in Step 3 is valid for the number of days specified in the OpenSSL command (730 days / ~2 years in the example above). Before it expires, repeat Steps 3–4 to generate and map a new certificate, then update the Certificate ID and Private Key in the Realm console. If a certificate expires or is revoked without a replacement mapped, Realm's polling will begin failing authentication.

Support ​

For additional details, refer to NetSuite's own OAuth 2.0 for Integration Application Developers documentation.

If you encounter any issues or require assistance, contact Realm Security support.