Link additional records to Major Security Incident

  • Release version: Xanadu
  • Updated August 1, 2024
  • 1 minute to read

    • In the workspace, use the linking records functionality to link any related Security Incident records and its child security incidents, Remediation Tasks from Vulnerability Response, and Security Cases from Threat Intelligence to a Major Security Incident (MSI) record.

    Before you begin

    Role required: sn_msi.workspace_manager and sn_msi.workspace_responder

    Procedure

    1. Navigate to Major Security Incident Response > MSIM Workspace.
    2. Navigate to the Lists view, which is displayed in the left pane of the workspace.
    3. Click Accepted to select the promoted major security incident records.
    4. Select the incident record that is required to be linked which is not in the Closed state from the list of promoted records.
    5. Click Linked Records tab.
      A drop-down list is provided to select other linked record tables.
      The Linked Records section displays the linked records and its related records, which were linked to the Major Security Incident.
    6. Select the desired table view such as Security Incidents, Remediation Tasks (vulnerable items), or Security Case from the list.
      Based on your selection type records table view, the linked records that linked to the major security incident records are displayed.
    7. Link a record that is not linked to any MSI record and is in the Open state by selecting the record and clicking Link Record in the top right of the page.
      Note:
      You can't link an incident record to an MSI record if it's in the Closed state.
    8. Select the record to be linked and click Link.
      A confirmation message displays that the record is linked successfully and the rollup of related records will be processed in the background.
      Note:
      After a record is linked, the list view is refreshed automatically and lists the updated list of incident records.