Rollup example use case implementation for a Security Case › Rollup Framework for MSIM › Major Security Incident Management › Security Incident Response › Enterprise security case management applications › Security Operations

Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Step 7. Create rollup record configurations

Create rollup record configuration to link and unlink additional records to MSI.

Before you begin

Role required: admin and sn_msi.workspace_admin

Note: The system admin can create the record and MSI workspace admin can update it.

To rollup information such as configuration items, observables, and indicator of compromise related to a Security case, create a rollup record configuration.

Procedure

Navigate to Major Security Incident Response > MSI Administration > Linked Record Configuration.

The Linked Record Configurations page displays.
Select or create a new linked record and navigate to the Rollup Record Configuration section from the same page.

Image omitted: roll-up-record-config.png
Rollup record configuration

What to do next

For more detailed information, see Configure Rollup Records in Major Security Incident Management
For a security case example information, see Writing script for a Security Case

Parent Topic:Rollup example use case implementation for a Security Case

Writing script for a Security Case

Writing a script for a Security Case to roll up record configuration.

Before you begin

Role required: admin and sn_msi.workspace_admin

Note: The system admin can create the record and MSI workspace admin can update it.

Procedure

Search for the Linked Record configurations using the left navigation.
Navigate to MSI Administration > Linked Record Configuration.
Open the configuration record which was created for a security case.
The Rollup Record configuration will be displayed in the Related List section.
Select New to create a new roll up record configuration.

Below is an example record created to Rollup Observables data related to Security Case we are trying to Rollup with the field values as:

Name Description

Roll up Type RelationshipNote: The observable information is available in a related list format.

Rollup Script

Input sourceSysId contains security case sys id and msiSysId contains major security incident sys id.

Image omitted: rollup-script-step7.png
Rollup script</p>

Line 2: As a first step, query for Glide Record for sourceSysId from <strong>Security Case(sn_ti_case)</strong> table.
<div class="highlight"><pre><span></span><code>-

Line 7: Next, query **sn\_ti\_m2m\_task\_observable** table using security case sys ID to figure out all the linked observables to a security case.

Line 10: Next, iterate over all the linked observables and link them to a Major Security Incident using the method:

MSIMRollupEngine.linkToMSI("entityGr”, “sourceSysId”, “fieldNameInLinkedRecordTable”, “msiSysId”, “isPrimaryRecord”)