Promote to a Major Security Incident

---
title: Promote to a Major Security Incident
description: Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management \(MSIM\) Workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/promote-msi.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-28"
reading_time_minutes: 2
keywords: [major security incident, promote, MSIM, candidates]
breadcrumb: [Propose, promote, and link incident records, Use, Major Security Incident Management, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Promote to a Major Security Incident

Promote a security incident to a major security incident or reject promoted proposals through the Major Security Incident Management \(MSIM\) Workspace.

## Before you begin

Role required: sn\_msi.workspace\_admin or sn\_msi.workspace\_manager

## Procedure

1.  Navigate to **Workspaces** > **Security Incident Response Workspace** > **Security Incidents** > **Lists**.

2.  Select the security incident in the related category that you want to promote as major security incident.

    Review the details of the security incident in the Details section or view extended details in the incident record in a separate tab by clicking **View more details**.

3.  Select the **More Actions** icon and select **Promote to Major Security Incident**.

4.  In the Promote Major Security Incident dialog box, fill in the fields.

    1.  **Detection Date**: Date when the major security incident was first created or proposed.

    2.  **Estimated resolution date**: The estimated resolution date by when the major security incident is estimated to be resolved.

    3.  **Code name**: Select the code name for the major security incident.

        For example, Blue Tiger.

    4.  **Category**: Select the category for the major security incident.

        For example, Misconfiguration.

    5.  **Justification**: Provide the justification for proposing the incident.

    6.  **Potential impact**: Indicate the impact of the incident.

5.  Select **Propose**.

6.  Either promote the security incident or reject the promotion proposal.

    -   To promote the incident, select **Promote to Major Security Incident**.
    -   To reject the promotion proposal, select **Reject as Major Security Incident**.
7.  Select **Save**.


## Result

-   If you rejected the promotion proposal, the incident is not promoted and the incident entry moves to the Rejected tab.
-   If you promoted the incident, the incident entry moves to the Open tab and the security record displays a tag indicating that it is a major security incident.
-   The decision is listed in the Activity section of the MSIM Workspace.

After an incident is promoted, the default configuration is applied.

-   A folder structure is created based on the folder template configuration.
-   Chat channels are created based on the channels configuration.
-   An email message is sent to the designated users. The default notification contains a link to the major security incident and details of the incident. The designated users also now have access to the collaboration resources, so the notification also includes the Microsoft Teams name and a link to Microsoft SharePoint folders related to the incident.

**Parent Topic:**[Propose, promote, and link incident records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/promoting-sir-to-msim.md)

**Related topics**  


[Propose as a Major Security Incident]()

[Link to Major Security Incident]()