---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Link to Major Security Incident

# Link to Major Security Incident {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Link security incidents to a major security incident.

## Before you begin

Role required: sn_msi.workspace_admin

## Procedure

1. Navigate to AllSecurity IncidentIncidentsShow All Incidents.
2. Select the security incident in the related category that you want to link to the major security incident.
3. Select the Additional Actions icon and select Link to Major Security Incident.
4. Select the major security incident to which you want to link.
   1. In the dialog box, select the Lookup using list icon.
   2. Select the major security incident you want to link to.
   3. Select OK.
   {#link-si-msi__substeps_otq_jlb_sqb}
5. Select Propose.
{#link-si-msi__steps_o5b_c41_wrb}

## Result

The proposal is submitted and the following actions occur:

* In the security incident record, a verification banner message is displayed
  and the defined Major Security Incident tag appears next to the
  Select security tag field.

* In the Details tab for the major security incident in
  Major Security Incident Management, the record number drop-down list
  includes both incidents.

* The record appears in the incident record's Major Security Incident related
  list, with the state listed as Proposed.

* A message is sent to those in the defined notification list that contains a
  link to the incident record and the Details tab for the incident.

* The Activity section in the MSIM Workspace shows that
  the security incident has been added as a child security incident to the
  major security incident with a link.

{#link-si-msi__ul_nhp_slb_sqb}
**Related tasks**   

* [Propose as a Major Security Incident](https://servicenow-prod.fluidtopics.net/m6qUwNXHPosFWQYfUNo7yQ "Propose a security incident to a major security incident.")
* [Promote to a Major Security Incident](https://servicenow-prod.fluidtopics.net/AthhVItLh5ohnsxWvMMSaQ "Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management (MSIM) Workspace.")

*[\>]: and then