--- title: Step 7. Create rollup record configurations description: Create rollup record configuration to link and unlink additional records to MSI.Writing a script for a Security Case to roll up record configuration. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/create-rollup-record-configurations.html release: australia product: Security Incident Response classification: security-incident-response topic_type: task last_updated: "2026-03-12" reading_time_minutes: 2 breadcrumb: [Rollup example use case implementation for a Security Case, Rollup Framework for MSIM, Major Security Incident Management, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Step 7. Create rollup record configurations Create rollup record configuration to link and unlink additional records to MSI. ## Before you begin Role required: admin and sn\_msi.workspace\_admin **Note:** The system admin can create the record and MSI workspace admin can update it. To rollup information such as configuration items, observables, and indicator of compromise related to a Security case, create a rollup record configuration. ## Procedure 1. Navigate to **Major Security Incident Response** > **MSI Administration** > **Linked Record Configuration**. The Linked Record Configurations page displays. 2. Select or create a new linked record and navigate to the **Rollup Record Configuration** section from the same page. \[Omitted image "roll-up-record-config.png"\] Alt text: Rollup record configuration ## What to do next - For more detailed information, see [Configure Rollup Records in Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/roll-up-record-configuration-in-major-security-incident-management.md) - For a security case example information, see [Writing script for a Security Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/create-rollup-record-configurations.md) **Parent Topic:**[Rollup example use case implementation for a Security Case](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/use-case-for-a-security-case.md) ## Writing script for a Security Case Writing a script for a Security Case to roll up record configuration. ### Before you begin Role required: admin and sn\_msi.workspace\_admin **Note:** The system admin can create the record and MSI workspace admin can update it. ### Procedure 1. Search for the Linked Record configurations using the left navigation. 2. Navigate to **MSI Administration** > **Linked Record Configuration**. 3. Open the configuration record which was created for a security case. 4. The Rollup Record configuration will be displayed in the Related List section. 5. Select **New** to create a new roll up record configuration. Below is an example record created to Rollup Observables data related to Security Case we are trying to Rollup with the field values as:
Name Description
Roll up Type Relationship**Note:** The observable information is available in a related list format.
Rollup Script Input sourceSysId contains security case sys id and msiSysId contains major security incident sys id.\[Omitted image "rollup-script-step7.png"\] Alt text: Rollup script - ``` Line 2: As a first step, query for Glide Record for sourceSysId from **Security Case\(sn\_ti\_case\)** table. ``` - ``` Line 7: Next, query **sn\_ti\_m2m\_task\_observable** table using security case sys ID to figure out all the linked observables to a security case. ``` - ``` Line 10: Next, iterate over all the linked observables and link them to a Major Security Incident using the method: ``` MSIMRollupEngine.linkToMSI\("entityGr”, “sourceSysId”, “fieldNameInLinkedRecordTable”, “msiSysId”, “isPrimaryRecord”\)