Working with MSI Records
Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.
After you install Major Security Incident Management (MSIM) on your ServiceNow AI Platform instance, you can then handle the transition of security incidents to major incidents.
The Major Security Incident Management (MSIM) UI actions are displayed on the top right of the security incident form banner of the SIR workspace. Select the UI action as applicable.
Note: Some actions are contextual. For example, Unlink action is available only when the security incident is already proposed or promoted or linked to a major security incident.
MSI integration
- Propose as Major Security Incident
Propose a security incident as a Major Security Incident (MSI). - Promote to Major Security Incident
Promote a security incident to major security incident. - Link to Major Security Incident
Link a security incident to a major security incident as child security incident(s).
Parent Topic:Using SIR Workspace
Related topics
Working with Security Incident Records
Prerequisites for the Playbooks
Rebuilding existing playbooks in Workflow Studio
Sample Playbooks for SIR Workspace