---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Track collaboration activity via MSIM workspace

# Track collaboration activity via MSIM workspace {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read

Track chat and file activities related to resolving major security incidents through the
MSIM Workspace.

Activities are coordinated using Microsoft Teams chat and Microsoft SharePoint files and folders and then posted back to the Major Security Incident via integrations.

Once Microsoft Teams and Microsoft SharePoint are integrated with Major Security Incident Management, you can use the MSIM Workspace
to track collaboration between incident response users and other groups who are contributing to
the resolution of a major security incident. Any updates to collaboration folders and files in
Microsoft SharePoint are synchronized with the MSIM Workspace File Explorer and also reflected in
the Activity stream components.  
When a security incident is promoted as major security incident:

1. A folder structure will be created in Microsoft SharePoint based on the folder template configuration. The same folder structure will be reflected on the File Explorer component of the workspace.
2. A team with multiple channels is created under Microsoft Teams application and the same will be reflected on the Chat Management component of the workspace.
{#collab-tab__ol_j2z_bqb_wrb}Role required: sn_msi.workspace_manager.
**Related concepts**   

* [Propose, promote, and link incident records](https://servicenow-prod.fluidtopics.net/sk9rqHFZOINPE0X~1U5vMg "Propose or promote security incidents as major security incidents when incidents are identified as critical threat to the organization.")
* [View Major Security Incident impact metrics](https://servicenow-prod.fluidtopics.net/3KBNBqRoz_BkHzUxpjZhkg "Provides up-to-date summary reporting of the impact and progress of major security incidents, which is an important aspect of managing a major security incident using the new workspace.")
* [View Major Security Incident trend charts](https://servicenow-prod.fluidtopics.net/i9L9Hku8t6K3KLufujwM_Q "View the major security incident impact progress metrics visualized as bar graphs and charts.")
* [Update Major Security Incident details](https://servicenow-prod.fluidtopics.net/b07ElfZGURoZjC6mrNQUPg "View and update specific details related to the major security incident such as Incident Record Details, Active Team participants, and the corresponding activity log.")
* [Manage tasks in a Major Security Incident](https://servicenow-prod.fluidtopics.net/Yru0dCGME5pKnCMaKxhciw "The Task tab enables you to track and manage all the tasks associated with a major security incident from the MSIM workspace. You can view the various tasks using the default Visual Task Board (Kanban view) or the List view.")  
**Related tasks**   

* [Using MSI List view in the MSIM workspace](https://servicenow-prod.fluidtopics.net/KCnBshkJxFxNQC_44tHI8g "With the list view in the MSIM workspace, you can view proposed, promoted, and rejected major security incidents.")
* [Link additional records to Major Security Incident](https://servicenow-prod.fluidtopics.net/_LFdjo1aOyMiYBIDPKWA7Q "In the workspace, use the linking records functionality to link any related Security Incident records and its child security incidents, Remediation Tasks from Vulnerability Response, and Security Cases from Threat Intelligence to a Major Security Incident (MSI) record.")
* [Unlink records from Major Security Incident](https://servicenow-prod.fluidtopics.net/T0_CeewhEttOZPLLg8B4Ww "Using the Major Security Incident Management workspace, unlink the major security incident records from the Linked Records section.")
* [Create and distribute MSIM Status Reports](https://servicenow-prod.fluidtopics.net/~mxDy9mmDysMOt7PL5mv3A "As a Major Security Incident (MSI) manager, you can create and distribute the different status reports to different stakeholders at various intervals based on the configured report template or a previous status report throughout the course of the major security incident resolution.")

## Interact with files and folders {#ariaid-title2}

The File Explorer displays the file system so you can view and interact with files and
folders related to resolving the incident.

Displays the file and folders which are captured at Microsoft SharePoint for a specific
security incident. These folders will be automatically created on Microsoft SharePoint for that
major security incident. You can use this default created folders to upload any supporting files,
if required. You can rename, move, or delete these files and folders as required.  
Also, whenever you upload a file to any of the folders, the activity corresponding to those folders will be automatically associated to the File Explorer folders in the Collaboration tab and the activity will be recorded and displayed in the Activity section of the Major Security Incident Management Workspace.  
Note:  
On the Collaboration tab, the incident record is appended to the parent file on the sharepoint with a unique incident number and incident category.

1. Repository view: Lists the files and folders which are listed in the Microsoft SharePoint for that specific security incident. For each file or folder the repository view displays the Name, Modified by, Last modified, and Size will be displayed. {#collab-tab-file-explorer__table_ajl_jsb_wrb__entry__2}

   | Field | Description |
   |-|-|
   | Open in SharePoint | Select this option available next to your major security incident. Click on the link to select and view the folder structure in Microsoft SharePoint. |
   | New Folder | Select this option to create a new folder as required. After you create a new folder, the same new folder is created and associated in your Microsoft SharePoint, by default. |
   [Table 1. Repository view]

   {#collab-tab-file-explorer__table_ajl_jsb_wrb}
2. Recents: Displays all the recent activity logs. These logs include both your SharePoint and File Explorer activities. The recent activities are usually your supporting files which are inclusive of the parent folder.

   Following is the procedure to
   Locate Log file:
   1. Select the respective file to view the details.
   2. Click Locate File.  
      Note:  
      The navigation and details of the parent file and the parent folders are displayed under the Recents list view section. You can open the same file in your SharePoint. Whenever you upload the related log files or any activities, all those files and activities are displayed both in SharePoint and File Explorer.
   {#collab-tab-file-explorer__ol_xdc_rsb_wrb}
{#collab-tab-file-explorer__ol_dw4_hsb_wrb}

## Manage Chat Channels communications using Microsoft Teams {#ariaid-title3}

The Chat Channel Manager displays Microsoft Teams with multiple channels created in the Microsoft Teams application based on a configuration template setup.  
These configured channels are reflected in the Chat Management component along with the users and user groups assigned to them. The Chat Channel Manager enables you to perform the following:

* Manage Chat channels
* Rename team
* Manage team members
{#collab-tab-chat-channel-manager__ul_wxv_kfs_gbc}The team and channels are created based on the Chat Channel configuration in Microsoft Teams.

### Manage Chat Channels {#collab-tab-chat-channel-manager__section_vm3_kds_gbc}

The Chat Channel Manager enables you to create, edit, or delete Chat Channels. To manage a Chat Channel in Microsoft Teams, perform the following steps:

1. Select the Collaboration tab.
2. Navigate to Chat Channel ManagerCreate New Channel.
3. Add a new Channel Name, Description, and select the Members for the channel.
4. Select Create.  
   Note:  
   A new channel record is created in the Microsoft Teams Channels section of the Microsoft Teams application and the same record will be reflected in MSIM.
5. To edit a Chat Channel, select a Chat Channel in the Chat Channel Manager list.
6. You can modify the Channel name, Members list, Group Members list based on your requirements.
7. Select Save.
8. To delete a Chat Channel, select a Chat Channel in the Chat Channel Manager list.
9. Select Delete Channel.
{#collab-tab-chat-channel-manager__ol_xtz_4ds_gbc}

### Rename Team {#collab-tab-chat-channel-manager__section_ifk_t2s_gbc}

To rename a team in Microsoft Teams, perform the following steps:

1. Select the Collaboration tab.
2. Navigate to Chat Channel ManagerRename team.
3. In the Team name field, rename the team according to your requirements.
4. Select Save.  
   Note:  
   Renaming the team name will also rename the team name in Microsoft Teams.
{#collab-tab-chat-channel-manager__ol_kgq_w2s_gbc}

### Manage team members {#collab-tab-chat-channel-manager__section_bl3_3gs_gbc}

The Chat Channel Manager enables you to add or remove team members in Microsoft Teams. You can also add members through groups. To manage team members in Microsoft Teams, perform the following steps:

1. Select the Collaboration tab.
2. Navigate to Chat Channel ManagerManage team members.
3. In the Members field, add or remove team members according to your requirements.
4. In the Add members via Groups field, select the groups that you want to add in Microsoft Teams.  
   Note:  
   If the group members are already on the team, then those members won't be added.
5. Select Save.

   The Chat Channel Manager displays the details of the total team members and the number of new members who will be added.
{#collab-tab-chat-channel-manager__ol_bmd_cjs_gbc}

## Manage Chat Channels communications using Slack {#ariaid-title4}

The Chat Channel Manager displays Slack with multiple channels created in the Slack application based on a configuration template setup.

These configured channels are reflected in the Chat Management component along with the users and user groups assigned to them. The Chat Channel Manager enables you to Manage Chat channels. The team and channels
are created based on the Chat Channel configuration in Slack.

### Manage Chat Channels {#collab-chat-channels-slack__section_vm3_kds_gbg}

The Chat Channel Manager enables you to create, edit, or delete Chat Channels in Slack. To manage a Chat Channel, perform the following steps:

1. Select the Collaboration tab.
2. Navigate to Chat Channel ManagerCreate New Channel.
3. Add a new Channel Name, Description, and select the Members for the channel.
4. Select Create.  
   Note:  
   A new channel record is created in the Slack Channels section of the Slack application and the same record will be reflected in MSIM.
5. To edit a Chat Channel, select a Chat Channel in the Chat Channel Manager list.
6. You can modify the Channel name, Members list, Group Members list based on your requirements.
7. Select Save.
8. To delete a Chat Channel, select a Chat Channel in the Chat Channel Manager list.
9. Select Delete Channel.
{#collab-chat-channels-slack__ol_xtz_4ds_gbg}

## Manage activity stream conversations {#ariaid-title5}

Displays all the activities, logs, status that were performed on Microsoft SharePoint, File explorer, and Microsoft Teams.

If you want to view any specific activity or search the collaboration activity details which
were interacted between various file and folders and also on Microsoft Teams, then you can use
the filter capability which is displayed on top right of the Activity Stream section and locate
the desired activity details.

Folders and chat conversations shared with Major Security Incident Management reflect as
breadcrumbs with the structure:  
connector application name (\<incident number -- category \> \<folder name\>).
Label the activities:

1. Select the Label icon.
2. Select the respective incident activity label check box.
3. The labeled activities are color coded and depicted as progress trend graph on the External Collaboration section of the workspace.
{#collab-activity-stream__ol_rdw_x5b_wrb}

*[\>]: and then