---
title: Working with MSI Records
description: Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/working-with-msi-records.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Working with MSI Records

Using the Security Incident Response workspace, you can propose, promote, or link security incidents as major security incidents when the incidents are identified as critical threat to the organization.

After you install Major Security Incident Management \(MSIM\) on your ServiceNow AI Platform instance, you can then handle the transition of security incidents to major incidents.

The Major Security Incident Management \(MSIM\) UI actions are displayed on the top right of the security incident form banner of the SIR workspace. Select the UI action as applicable.

**Note:** Some actions are contextual. For example, Unlink action is available only when the security incident is already proposed or promoted or linked to a major security incident.

\[Omitted image "msi-records.png"\] Alt text: MSI integration

-   **[Propose as Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/propose-to-major-security-incident.md)**  
Propose a security incident as a Major Security Incident \(MSI\).
-   **[Promote to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/promote-to-major-security-incident.md)**  
Promote a security incident to major security incident.
-   **[Link to Major Security Incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/link-to-major-security-incident.md)**  
Link a security incident to a major security incident as child security incident\(s\).

**Parent Topic:**[Using SIR Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/using-sir-workspace.md)

**Related topics**  


[Using ServiceNow Otto for Security Incident Response \(SIR\) generative AI skills]()

[Using agentic AI workflows]()

[Working with Security Incident Records]()

[Security Incident Playbook]()

[Prerequisites for the Playbooks]()

[Rebuilding existing playbooks in Workflow Studio]()

[Activity Definitions]()

[Sample Playbooks for SIR Workspace]()

[Working with Form UI actions]()

[Security Incident Closure workflow]()

[Handle security incidents using Advanced Work Assignment]()