---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Propose, promote, and link incident records

# Propose, promote, and link incident records {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Propose or promote security incidents as major security incidents when incidents are
identified as critical threat to the organization.

Once Major Security Incident Management is installed on your ServiceNow
instance, you can handle the transition of security incidents to major incidents as follows:

* Propose a security incident to major security incident candidate to initiate a review process.
* Directly promote a security incident to a major security incident without a review process.
* Reject a security incident proposed as a major security incident.

{#promoting-sir-to-msim__ul_sht_431_sqb}

You can also link a security incident as a child incident to the major security incident so
that all related security incidents can be tracked together.
* **[Propose as a Major Security Incident](https://servicenow-prod.fluidtopics.net/m6qUwNXHPosFWQYfUNo7yQ)**   
  Propose a security incident to a major security incident.
* **[Promote to a Major Security Incident](https://servicenow-prod.fluidtopics.net/AthhVItLh5ohnsxWvMMSaQ)**   
  Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management (MSIM) Workspace.
* **[Link to Major Security Incident](https://servicenow-prod.fluidtopics.net/QSupANeHEuMHdWLwo8J2nw)**   
  Link security incidents to a major security incident.

**Related concepts**   

* [View Major Security Incident impact metrics](https://servicenow-prod.fluidtopics.net/3KBNBqRoz_BkHzUxpjZhkg "Provides up-to-date summary reporting of the impact and progress of major security incidents, which is an important aspect of managing a major security incident using the new workspace.")
* [View Major Security Incident trend charts](https://servicenow-prod.fluidtopics.net/i9L9Hku8t6K3KLufujwM_Q "View the major security incident impact progress metrics visualized as bar graphs and charts.")
* [Update Major Security Incident details](https://servicenow-prod.fluidtopics.net/b07ElfZGURoZjC6mrNQUPg "View and update specific details related to the major security incident such as Incident Record Details, Active Team participants, and the corresponding activity log.")
* [Manage tasks in a Major Security Incident](https://servicenow-prod.fluidtopics.net/Yru0dCGME5pKnCMaKxhciw "The Task tab enables you to track and manage all the tasks associated with a major security incident from the MSIM workspace. You can view the various tasks using the default Visual Task Board (Kanban view) or the List view.")
* [Track collaboration activity via MSIM workspace](https://servicenow-prod.fluidtopics.net/oN75Hkl13nFA0yi30ej7pw#collab-tab "Track chat and file activities related to resolving major security incidents through the MSIM Workspace.")  
**Related tasks**   

* [Using MSI List view in the MSIM workspace](https://servicenow-prod.fluidtopics.net/KCnBshkJxFxNQC_44tHI8g "With the list view in the MSIM workspace, you can view proposed, promoted, and rejected major security incidents.")
* [Link additional records to Major Security Incident](https://servicenow-prod.fluidtopics.net/_LFdjo1aOyMiYBIDPKWA7Q "In the workspace, use the linking records functionality to link any related Security Incident records and its child security incidents, Remediation Tasks from Vulnerability Response, and Security Cases from Threat Intelligence to a Major Security Incident (MSI) record.")
* [Unlink records from Major Security Incident](https://servicenow-prod.fluidtopics.net/T0_CeewhEttOZPLLg8B4Ww "Using the Major Security Incident Management workspace, unlink the major security incident records from the Linked Records section.")
* [Create and distribute MSIM Status Reports](https://servicenow-prod.fluidtopics.net/~mxDy9mmDysMOt7PL5mv3A "As a Major Security Incident (MSI) manager, you can create and distribute the different status reports to different stakeholders at various intervals based on the configured report template or a previous status report throughout the course of the major security incident resolution.")