---
title: Propose as a Major Security Incident
description: Propose a security incident to a major security incident.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/propose-as-msi.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-28"
reading_time_minutes: 1
breadcrumb: [Propose, promote, and link incident records, Use, Major Security Incident Management, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Propose as a Major Security Incident

Propose a security incident to a major security incident.

## Before you begin

Role required: sn\_si.analyst

## Procedure

1.  Navigate to **Workspaces** > **Security Incident Response Workspace** > **Security Incidents** > **Lists**.

2.  Select the security incident in the related category that you want to propose as a major security incident.

3.  Select the **More Actions** icon and select **Propose as Major Security Incident**.

4.  In the Propose as Major Security Incident dialog box, fill in the fields.

    1.  **Detection Date**: Date when the major security incident was first created or proposed.

    2.  **Justification**: Provide the justification for proposing the incident.

    3.  **Potential impact**: Indicate the impact of the incident.

5.  Select **Propose**.


## Result

The incident is proposed and the following actions occur:

-   In the security incident record, a verification banner message is displayed and the defined Major Security Incident tag appears.

-   The record appears in the Major Security Incident related list in the incident record, with the state listed as Proposed. It also appears in the Proposed list in the MSIM Workspace.

-   The Activity section in the MSIM Workspace shows that the security incident has been proposed to be promoted as a major security incident.
-   A message is sent to those in the defined notification list that contains a link to the incident record and the Details tab for the incident.


**Parent Topic:**[Propose, promote, and link incident records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/promoting-sir-to-msim.md)

**Related topics**  


[Promote to a Major Security Incident]()

[Link to Major Security Incident]()