Skip to content
Working with MSI Records › Use › Security Incident Response Workspace › Security Incident Response › Enterprise security case management applications › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Promote to Major Security Incident

Promote a security incident to major security incident.

Before you begin

Role required: sn_si.analyst.

Procedure

  1. Navigate to Workspaces > Security Incident Response Workspace.

  2. Open any security incident.

  3. Click Promote to Major Security Incident.

  4. On the form, fill in the fields such as Detection date, Estimated resolution date, Justification, and Potential impact.

Image omitted: promote-msi.png
Promote incident

  1. Click Promote.

    The incident record is promoted as a major security incident.

    After the incident record is promoted as a major security incident, Major Security Incident tag is applied and displayed on the form banner.

    Note: You can also unlink the major security incident if the incident is not critical, the incident will then be unlinked and lists under the list view for the security analyst remediation.

Parent Topic:Working with MSI Records