Major Security Incident Management
Summarize
Summary of Major Security Incident Management
Major Security Incident Management (MSIM) enhances the process of tracking and resolving major security incidents within ServiceNow. It integrates with the existing Security Incident Response capabilities, allowing security analysts to escalate standard incidents to major incidents. Analysts can propose, promote, or reject incidents as major security incidents and link related child incidents to ensure coordinated remediation efforts. This streamlined approach supports effective collaboration and incident management through an intuitive workspace designed for incident managers and responders.
Show less
Key Features
- Dedicated Workspace: Tailored for Major Security Incident Managers to efficiently manage major incidents.
- Incident Organization: Ability to manage multiple child security incidents under a major incident to coordinate response tasks.
- Automated Collaboration: Automatic creation and archival of collaboration folders and chat channels upon incident creation and closure.
- File Management: File explorer integrated with Microsoft SharePoint to organize and track incident-related artifacts.
- Communication Integration: Chat channel manager and activity stream components integrated with Microsoft Teams to facilitate communication across security, IT, and functional teams.
Workspace Components
The product includes several user interface enhancements and components within the workspace that support the above features, including tools for task organization, file management, and communications—all optimized for the Major Security Incident Manager role.
Compatibility and Requirements
- MSIM requires ServiceNow AI Platform® Rome or later versions.
- Supports Microsoft Teams integration, part of Microsoft Office 365, to enable chat-centered collaboration.
- Installation prerequisites include the Security Incident Response plugin and related Security Operations applications, which can be installed from the ServiceNow Store in a specified order to ensure smooth setup.
Practical Benefits
ServiceNow customers adopting Major Security Incident Management can expect improved control and visibility over major security incidents, enhanced cross-team communication, and streamlined incident resolution processes. The integration with Microsoft Teams and SharePoint facilitates centralized collaboration and artifact management, making it easier to handle complex security incidents efficiently.
Track and manage various activities that are typically part of resolving a major security incident through Major Security Incident Management. Through an intuitive workspace, incident managers and those working on an incident can propose and promote incidents to major incidents, track major security incident activities, and easily collaborate with colleagues.
Major Security Incident Management Overview
The major security incident management capabilities work in conjunction with the existing security incident response product capabilities. This includes an ability for a security analyst to escalate a standard security incident to a major security incident, so that the new product capabilities are available to support the remediation process.
After you install on your ServiceNow instance, a security incident analyst can:
- Propose a security incident to major security incident candidate to initiate a review process on the need to create a major security incident.
- Directly promote a security incident to a major security incident without the need for an additional review process.
- Reject a security incident that is proposed as a major security incident (MSI).
- Link a security incident as a child incident to the major security incident (MSI) so that all security incidents can be worked.
Key features
Major Security Incident Management (MSIM) improves the major security incident remediation process with the following features:
- Dedicated workspace for managing major security incidents designed for the major security incident manager user role.
- Organize response tasks across multiple 'child' security incidents.
- Automate creation of collaboration folders and chat communication channels after a major security incident is created, as well as archival as part of incident closure.
- File explorer component to organize and track the collection of artifacts (files) related to the major security incident via a Microsoft SharePoint integration.
- Chat channel manager and activity stream components to manage communications across multiple security, IT, and functional groups via a Microsoft Teams integration.
Workspace Components
The Major Security Incident Management product contains several new workspace components and user interface pages that deliver the key features functionality:
- Dedicated workspace for managing major security incidents specifically designed for the major Security Incident Manager user role.
- Organize response tasks across multiple child security incidents.
- Automate creation of collaboration folders and chat communication channels after a major security incident is created, as well as archival as part of incident closure.
- File explorer component to organize and track the collection of artifacts (files) related to the major security incident via a Microsoft SharePoint integration.
- Chat channel manager and activity stream components to manage communications across multiple security, IT, and functional groups via a Microsoft Teams integration.
Supported Major Security Incident Management versions
Major Security Incident Management (MSIM) requires ServiceNow AI Platform® Rome version.
This feature supports Microsoft Teams, which is a chat-centered workspace in the Microsoft Office 365 suite. Earlier Microsoft Teams was a separate installation from Microsoft Office 365 applications.
Supported ServiceNow AI Platform versions
This feature is supported on Rome and later releases.
- Security Incident Response: com.snc.si_dep is the dependent plugin. Installing this plugin activates the other Security Operations applications.
- Security Integration Framework
- Security Support Common
- Security Support Common Orchestration