---
url: https://docs.realmsec.info/integration/netsuite_audit_logs.md
---

# NetSuite Audit Logs

Realm Security integrates with NetSuite to collect audit log data (system notes tracking
record changes, logins, and configuration changes) for security monitoring and compliance.

Realm connects to NetSuite using OAuth 2.0 machine-to-machine (M2M) authentication — a
certificate-based flow that doesn't require a NetSuite user to log in interactively. Setup
involves creating an integration record in NetSuite, generating a certificate, and mapping
that certificate to a role before providing the resulting credentials to Realm.

## Prerequisites

* Administrative access to your NetSuite account, or a role with the **OAuth 2.0 Authorized
  Applications Management** permission.
* OpenSSL installed on your machine (or an equivalent tool for generating an RSA or EC key
  pair and self-signed certificate).
* Realm Collector is set up and running, or access to the Realm console to configure a
  NetSuite source directly, depending on your deployment.

## Overview

1. NetSuite: Enable the OAuth 2.0 feature
2. NetSuite: Create an integration record
3. NetSuite: Generate a certificate and private key
4. NetSuite: Map the certificate to a role (OAuth 2.0 Client Credentials M2M Setup)
5. NetSuite: Confirm the role has the required permissions
6. Realm Console: Configure the NetSuite Input Feed

## 1. NetSuite: Enable the OAuth 2.0 Feature

1. Log in to NetSuite as an Administrator.
2. Navigate to **Setup > Company > Enable Features**.
3. Select the **SuiteCloud** subtab.
4. Check the box to enable **OAuth 2.0**.
5. Click **Save**.

## 2. NetSuite: Create an Integration Record

1. Navigate to **Setup > Integration > Manage Integrations > New**.
2. Give the integration a name (e.g. `Realm Security`).
3. Under **Authentication**, check **Client Credentials (Machine to Machine) Grant**.
4. Set **State** to `Enabled`.
5. Click **Save**.

   > **Important:** After saving, NetSuite displays a **Client ID**. Store this value
   > immediately — it cannot be retrieved again after you leave this page. You will need it
   > when configuring the NetSuite Input Feed in the Realm console.

## 3. NetSuite: Generate a Certificate and Private Key

Realm authenticates using a certificate rather than a shared secret. Generate a key pair and
self-signed certificate using OpenSSL:

```
openssl req -x509 -newkey rsa:4096 -sha256 -days 730 -nodes \
  -keyout realm_private_key.pem -out realm_certificate.pem
```

This produces two files:

* `realm_certificate.pem` — the **public** certificate. This gets uploaded to NetSuite in the
  next step.
* `realm_private_key.pem` — the **private key**. This is never uploaded to NetSuite — store it
  securely, as it will be provided directly to Realm when configuring the input feed.

> **Note:** NetSuite also supports EC keys (`ES256`/`ES384`/`ES512`) as an alternative to RSA
> (`PS256`/`PS384`/`PS512`). The command above generates an RSA key; use an equivalent
> `openssl ecparam` command if you prefer an EC key instead.

## 4. NetSuite: Map the Certificate to a Role

Uploading a certificate isn't enough on its own — NetSuite requires an explicit mapping
between the integration record, a role, and the certificate before the flow will work.

1. Navigate to **Setup > Integration > Manage Authentication > OAuth 2.0 Client Credentials
   (M2M) Setup**.
2. Click **Create New**.
3. In the popup window:
   > **Entity:** Select the user this integration should run as. Realm recommends a
   > dedicated integration user rather than a personal account.
   > **Role:** Select the role assigned to that user. This role must be created as an
   > Administrator role — see [Step 5](#_5-netsuite-confirm-role-permissions) below for why.
   > **Application:** Select the integration record you created in Step 2. This option is
   > only available if **Client Credentials (Machine to Machine) Grant** was checked on that
   > record.
   > **Certificate:** Upload `realm_certificate.pem` from Step 3.
4. Click **Save**.

   > **Important:** After saving, the mapping appears in the list on this page along with a
   > generated **Certificate ID**. Store this value — you will need it, along with the
   > Client ID and your private key, when configuring the NetSuite Input Feed in the Realm
   > console.

> **Note:** This mapping is specific to the NetSuite account you configured it in — it does
> not carry over to sandbox or Release Preview accounts, and is cleared whenever a sandbox
> account is refreshed. If you're testing in a sandbox first, you'll need to repeat this step
> again for production.

## 5. NetSuite: Confirm Role Permissions

> **Important:** The role selected in Step 4 must be created as an Administrator role, not a
> limited or least-privilege custom role. NetSuite scopes System Note visibility to what the
> assigned role can see — a role that is scoped to a specific user or a restricted set of
> records will authenticate successfully but return no data when Realm queries System Notes.
> Create the role by copying the standard **Administrator** role rather than building a
> narrower custom role.

The role selected in Step 4 needs, at minimum:

* Administrator-level access, so **System Notes** are visible across all record types you
  want audited — this is the data Realm queries for audit log collection.
* **REST Web Services** permission enabled, so the integration can call NetSuite's REST /
  SuiteQL endpoints.
* **Log in using OAuth 2.0 Access Tokens** permission enabled, so the role can authenticate
  via the OAuth 2.0 client credentials (M2M) flow.

To add the **Log in using OAuth 2.0 Access Tokens** permission to the role:

1. Navigate to **Setup > Users/Roles > Manage Roles**.
2. Click **Edit** next to the role selected in Step 4.
3. Go to the **Permissions** subtab, then the **Setup** sub-subtab.
4. From the dropdown, select **Log in using OAuth 2.0 Access Tokens** and click **Add**.
5. Click **Save**.

If you're unsure which permissions your selected role already grants, review the role under
**Setup > Users/Roles > Manage Roles**. Do not scope this role down to a narrower custom role
— System Notes will not be returned for a role that isn't Administrator-level.

## 6. Realm Console: Configure the NetSuite Input Feed

1. Login to the Realm console.
2. Go to **Sources > Add** and add a new Source.
   > **Name:** `NetSuite`
   > **Description:** `NetSuite audit logs`
   > **Format:** `NetSuite Audit Logs`
3. Provide the following values, gathered from the steps above:
   > **Account ID:** Your NetSuite account ID (visible in your NetSuite login URL, e.g.
   > `https://<accountID>.app.netsuite.com`).
   > **Client ID:** From Step 2.
   > **Certificate ID:** From Step 4.
   > **Private Key:** The contents of `realm_private_key.pem` from Step 3.

Realm will use these credentials to sign a JWT, exchange it for an access token, and begin
polling NetSuite's SystemNote data on your behalf. No further action is required in NetSuite
unless your certificate expires or is revoked — see the note below.

> **Note on certificate expiration:** the certificate generated in Step 3 is valid for the
> number of days specified in the OpenSSL command (`730` days / ~2 years in the example
> above). Before it expires, repeat Steps 3–4 to generate and map a new certificate, then
> update the Certificate ID and Private Key in the Realm console. If a certificate expires or
> is revoked without a replacement mapped, Realm's polling will begin failing authentication.

## Support

For additional details, refer to NetSuite's own [OAuth 2.0 for Integration Application
Developers](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157780218434.html)
documentation.

If you encounter any issues or require assistance, contact Realm Security support.