---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Perform on demand atomic rollup

# Perform on demand atomic rollup {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Rollup framework cannot handle updates to the existing linked records. In such cases, on
demand atomic rollup should happen for linked records, which can be achieved via business
rules.

To capture updates to the linked records, business rules must be created on the source
table.

These business rules work on insert, update, and delete operations. When you perform insert or
update, you need to add or update rolled up information to MSI. If
you delete then the rolled up information will be removed from MSI.

For example, once a security incident is linked to MSI, the
related information will be rolled up automatically MSI. But
later, if you add a new observable to an MSI, then the newly added
observable also will be rolled up to MSI. Here, Sync rolled up observable business rule captures the update and rollup the updated record
to MSI. Similarly, the same business rule also handles the removal
of the existing rolled up observables, if it gets removed from the security incident.
{#perform-on-demand-atomic-rollup__table_kxs_g2r_j5b__entry__2}

| Rule | Description |
|-|-|
| Sync rolled up indicator (sn_ti_m2m_task_indicator) | Use this business rule to handle the rollup and removal of indicator of compromise from Security Incident, Security Case, and Remediation task. |
| Sync rolled up observable (sn_ti_m2m_task_observable) | Use this business rule handles the rollup and removal of linked observables from Security Incident, Security Case, and Remediation task. |
| Sync rolled up affected user (sn_si_m2m_task_affected_user) | Use this business rule handles the rollup and removal of linked affected users from Security Incident, Security Case and Remediation task. |
| Sync rolled up affected CI (task_ci) | Use this business rule handles the rollup and removal of associated configuration items from Security Incident, Security Case and Remediation task. |
[Table 1. Predefined business rulesFollowing are a few predefined business rules that helps you understand on how to handle atomic rollups]

{#perform-on-demand-atomic-rollup__table_kxs_g2r_j5b}
**Related concepts**   

* [Configure Linked Records in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/UQvZiFC9DqKWKX5KKQIwPw "Use Linked Records Configuration to store the information of task tables that can be used to link/promote/propose to Major Security Incident.")
* [Configure Rollup Records in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/9eu8e6Eam7vQOe4fzwglrQ "Configure Roll up records in Major Security Incident Management to control the information, which will be rolled up when the source record is linked/proposed/promoted as Major Security Incidents.")
* [Configure List Layout in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/xQN9l~z~JkKN8cPgqDDKBw "Configure list layout to customize the layout and labels used in Major Security Incident Management workspace such as Incident Impact, Linked Records, and Threat Intelligence tabs.")
* [Rollup example use case implementation for a Security Case](https://servicenow-prod.fluidtopics.net/3UAb9GHfMcTZxPwGU~hMWg "The following steps explain an example use case on how to add support to link/propose/promote to Major Security Incident for a Security Case table.")