---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Step 7. Create rollup record configurations

# Step 7. Create rollup record configurations {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create rollup record configuration to link and unlink additional records to
MSI.

## Before you begin

Role required: admin and sn_msi.workspace_admin  
Note:  
The system admin can create the record and MSI workspace admin can update it.

To rollup information such as configuration items, observables, and indicator of
compromise related to a Security case, create a rollup record configuration.

## Procedure

1. Navigate to Major Security Incident ResponseMSI AdministrationLinked Record Configuration.  
   The Linked Record Configurations page displays.
2. Select or create a new linked record and navigate to the Rollup Record Configuration section from the same page.  
   Figure 1. Rollup Record Configuration section

## What to do next

* For more detailed information, see [Configure Rollup Records in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/9eu8e6Eam7vQOe4fzwglrQ "Configure Roll up records in Major Security Incident Management to control the information, which will be rolled up when the source record is linked/proposed/promoted as Major Security Incidents.")
* For a security case example information, see [Writing script for a Security Case](https://servicenow-prod.fluidtopics.net/Gtb~9WLM2wIwDp9AHQBSEg#writing-script-for-security-case "Writing a script for a Security Case to roll up record configuration.")
{#create-rollup-record-configurations__ul_vf2_qsg_35b}

## Writing script for a Security Case {#ariaid-title2}

Writing a script for a Security Case to roll up record configuration.

### Before you begin

Role required: admin and sn_msi.workspace_admin  
Note:  
The system admin can create the record and MSI workspace admin can update it.

### Procedure

1. Search for the Linked Record configurations using the left navigation.
2. Navigate to MSI AdministrationLinked Record Configuration.
3. Open the configuration record which was created for a security case.
4. The Rollup Record configuration will be displayed in the Related List section.
5. Select New to create a new roll up record configuration.  
   Below is an example record created to Rollup Observables data related to Security Case we are trying to Rollup with the field values as:{#writing-script-for-security-case__table_fd3_qtc_35b__entry__2}

   | Name | Description |
   |-|-|
   | Roll up Type | Relationship Note: The observable information is available in a related list format. |
   | Rollup Script | Input sourceSysId contains security case sys id and msiSysId contains major security incident sys id. * Line 2: As a first step, query for Glide Record for sourceSysId from Security Case(sn_ti_case) table. * Line 7: Next, query sn_ti_m2m_task_observable table using security case sys ID to figure out all the linked observables to a security case. * Line 10: Next, iterate over all the linked observables and link them to a Major Security Incident using the method: MSIMRollupEngine.linkToMSI("entityGr", "sourceSysId", "fieldNameInLinkedRecordTable", "msiSysId", "isPrimaryRecord") {#writing-script-for-security-case__ul_fcl_5tc_35b} |
   [ ]

   {#writing-script-for-security-case__table_fd3_qtc_35b}

*[\>]: and then