---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure Rollup Records in Major Security Incident Management

# Configure Rollup Records in Major Security Incident Management {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configure Rollup Records in Major Security Incident Management

This feature enables ServiceNow administrators and MSI workspace admins to configure how information is aggregated ("rolled up") from source records when they are linked, proposed, or promoted as Major Security Incidents (MSI).
Rollup configurations help control the data visibility and relationship structure within the MSI workspace, ensuring relevant details from related records are properly reflected in the MSI context.
Show full answer Show less  

## Configuration Process

* Access the **Linked Records Configuration** under **Major Security Incident Response**.
* Create or select an existing linked record configuration.
* Within the configuration, navigate to the **Rollup Record Configuration** section and create a new rollup record.
* Provide essential details such as:
  * **Name:** Identifier for the rollup record.
  * **Active:** Enable to apply the rollup configuration.
  * **Linked Record Configuration:** Read-only reference to the parent linked record.
  * **Source Table:** Read-only source table involved in the linked record.
  * **Rollup Type:** Choose between *Relationship* (data appears as related list) or *Reference* (data is a reference field on the source table form).
* Depending on the rollup type:
  * **Relationship:** Enable and write a **Rollup Script** to query related tables and populate the linked record table (`snmsim2mchild`).
  * **Reference:** Select specific **Source Field** from the source table and map it to a **Target Field** in the linked record table.

## Scripting Details for Relationship Rollups

The rollup script receives two inputs:

* **sourceSysId:** Sys ID of the source record being linked or promoted.
* **msiSysId:** Sys ID of the Major Security Incident record.

The script uses these inputs to query related records and roll up relevant data into the `snmsim2mchild` table using the MSIRollupEngine utility. No output value is required.

## Roles and Permissions

* **System Administrator:** Can create rollup records.
* **MSI Workspace Admin:** Can update existing rollup records.

## Practical Benefits for ServiceNow Customers

* Allows precise control over which related data is surfaced within Major Security Incidents.
* Supports complex data relationships through scripting to aggregate information effectively.
* Improves incident response by consolidating relevant information from multiple related records.
* Ensures flexibility by supporting both related list style rollups and direct reference field rollups.

## Related Capabilities

* Configuring Linked Records in Major Security Incident Management.
* Configuring list layouts within the MSI workspace.
* Implementing rollup example use cases for Security Cases.
* Performing on-demand atomic rollups.  
Configure Roll up records in Major Security Incident Management to control the
information, which will be rolled up when the source record is linked/proposed/promoted as Major
Security Incidents.  
Role required: admin and sn_msi.workspace_admin.  
Note:  
The system admin can create the record and MSI workspace admin can update it.  
Procedure

1. Navigate to Major Security Incident ResponseLinked Records Configuration. The Linked Record Configurations page displays.
2. Select or create a new linked record and navigate to the Roll up Record Configuration section from the same page.Figure 1. Rollup Record Configuration section
3. Select New.

4. On the configuration page, fill the details.{#roll-up-record-configuration-in-major-security-incident-management__table_sbs_d1v_h5b__entry__2}

   | Field Name | Field Description |
   |-|-|
   | Name | Indicates the name of the rolling up record. |
   | Active | Select this check box to implement the current configuration when rollup of source record happens. |
   | Linked Record Configuration | Indicates a unique number, which refers to your parent linked records configuration and read-only. |
   | Source Table | The source table name used in the Linked Record configuration, which is read-only. |
   | Rollup Type | Describes the type of information which should be rolled up. * Relationship: Select this option if the data need to be present as a related list. * Reference: Select this option if the data is present as a reference field on the source table form. {#roll-up-record-configuration-in-major-security-incident-management__ul_gzn_y1v_h5b} |
   | Rollup Script | If the rollup type is: Relationship, then the Rollup Script field is enabled, which allows you to write script and can be used to rollup information. Here the script will receive the inputs which contains information of the source record and major security incident. The script should be able to find the information from the relationship tables and rollup to Linked Record (sn_msi_m2m_child) table. |
   | Source Field | If the rollup type is: Reference, then the Source Field is available. This enables you to select the Source Table reference field which contains the information that needed to be rolled up. |
   | Target Field | If the rollup type is: Reference, then the Target Field is available. This enables you to reference field from the Linked Record(sn_msi_m2m_child) table and will store the data which is present in the selected Source Field and in the Source Table record. |
   [Table 1. Rollup Record Configuration]

   {#roll-up-record-configuration-in-major-security-incident-management__table_sbs_d1v_h5b}
{#roll-up-record-configuration-in-major-security-incident-management__ol_pry_3ws_h5b}

Writing script for rollup
{#roll-up-record-configuration-in-major-security-incident-management__table_zmh_yjc_35b__entry__2}

| Name | Description |
|-|-|
| Inputs | * sourceSysId: Sys ID of source table record which is either getting linked / proposed / promoted. * msiSysId: Sys ID of major security incident to which source record is getting linked / proposed / promoted. {#roll-up-record-configuration-in-major-security-incident-management__ul_bfc_1kc_35b} |
| Output | No output return value. |
| Responsibility | Script should rollup information to Linked Record(sn_msi_m2m_child) table. * Use sourceSysID to query data from ServiceNow relationship tables. * After the data is fetched, roll up the data to a Linked Record (sn_msi_m2m_child) using MSIRollupEngine utility to roll up data. {#roll-up-record-configuration-in-major-security-incident-management__ul_mkc_fkc_35b} |
[ ]

{#roll-up-record-configuration-in-major-security-incident-management__table_zmh_yjc_35b}
**Related concepts**   

* [Configure Linked Records in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/UQvZiFC9DqKWKX5KKQIwPw "Use Linked Records Configuration to store the information of task tables that can be used to link/promote/propose to Major Security Incident.")
* [Configure List Layout in Major Security Incident Management](https://servicenow-prod.fluidtopics.net/xQN9l~z~JkKN8cPgqDDKBw "Configure list layout to customize the layout and labels used in Major Security Incident Management workspace such as Incident Impact, Linked Records, and Threat Intelligence tabs.")
* [Rollup example use case implementation for a Security Case](https://servicenow-prod.fluidtopics.net/3UAb9GHfMcTZxPwGU~hMWg "The following steps explain an example use case on how to add support to link/propose/promote to Major Security Incident for a Security Case table.")
* [Perform on demand atomic rollup](https://servicenow-prod.fluidtopics.net/Ot5f8sN78VS7PvaJM5joDg "Rollup framework cannot handle updates to the existing linked records. In such cases, on demand atomic rollup should happen for linked records, which can be achieved via business rules.")

*[\>]: and then