Working with MSI Records

Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.

After you install Major Security Incident Management (MSIM) on your ServiceNow AI Platform instance, you can then handle the transition of security incidents to major incidents.

The Major Security Incident Management (MSIM) UI actions are displayed on the top right of the security incident form banner of the SIR workspace. Select the UI action as applicable.

Note:

Some actions are contextual. For example, Unlink action is available only when the security incident is already proposed or promoted or linked to a major security incident.

• Propose as Major Security Incident
  Propose a security incident as a Major Security Incident (MSI).
• Promote to Major Security Incident
  Promote a security incident to major security incident.
• Link to Major Security Incident
  Link a security incident to a major security incident as child security incident(s).

Related concepts

• Working with Security Incident Records
• Security Incident Playbook
• Prerequisites for the Playbooks
• Rebuilding existing playbooks in Workflow Studio
• Activity Definitions
• Sample Playbooks for SIR Workspace
• Working with Form UI actions

Related tasks

• Security Incident Closure workflow
• Handle security incidents using AWA