Unlink records from Major Security Incident

  • Release version: Zurich
  • Updated July 31, 2025
  • 1 minute to read

    • Using the Major Security Incident Management workspace, unlink the major security incident records from the Linked Records section.

    Before you begin

    Role required: sn_msi.workspace_manager and sn_msi.workspace_responder

    Note:
    You can only unlink a single record at a time. After you unlink a record, the related rolled up information will be removed from the Incident Impact and Threat Intelligence sections on the workspace and the action can't be undone.
    For more information on roll up records, see Rollup Framework for MSIM.

    Procedure

    1. Navigate to Major Security Incident Response > MSIM Workspace.
    2. Navigate to Lists view, which is displayed in the left pane of the workspace.
    3. Select Accepted to select the promoted major security incident records.
    4. Select the Linked Records tab.
      This section displays the linked records and its related records, which are linked to the Major Security Incident.
    5. Select the desired table view such as Security Incidents, Remediation Tasks (vulnerable items), or Security Case.
    6. Select the record to unlink from the list view of records.
    7. Select Unlink Record.
      Figure 1. Unlink Record
      Unlink Record remediation task.
    8. A warning message is displayed asking if you want to unlink the selected record from MSI.
      Figure 2. Unlink Record Warning Message
      Unlink Record warning message.
    9. Select Unlink Record.
      The record is unlinked and once unlinked, the changes can't be reverted. The list view of Linked Records will be refreshed after unlinking.