Propose as Major Security Incident

task australia Updated Sep 10, 2026 1 min read propose-to-major-security-incident.md

Raw file servicenow.com

Propose a security incident as a Major Security Incident (MSI).

Before you begin

Role required: sn_si.analyst.

Procedure

Navigate to Workspaces > Security Incident Response Workspace.
Open any security incident.
Click Propose to Major Security Incident.

[Omitted image "propos-msi.png"] Alt text: Propose incident
On the form, fill in the fields such as Detection date, Justification, and Potential impact.
Click Propose.

The incident record is proposed as a major security incident candidate.

After the incident record is proposed as a major security incident candidate, Major Security Incident Candidate tag is applied and displayed on the security incident form banner.

Note: Click Unlink from Major Security Incident to unlink the incident if you don't wish to propose or doesn't have any critical impact. The incident will be unlinked and lists under the list view to the security analyst for remediation.

Parent Topic:Working with MSI Records

46 lines · 1.8 KB Wrap lines

---
title: Propose as Major Security Incident
description: Propose a security incident as a Major Security Incident \(MSI\).
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/propose-to-major-security-incident.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Working with MSI Records, Use, Security Incident Response Workspace, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Propose as Major Security Incident

Propose a security incident as a Major Security Incident \(MSI\).

## Before you begin

Role required: sn\_si.analyst.

## Procedure

1. Navigate to **Workspaces** &gt; **Security Incident Response Workspace**.

2. Open any security incident.

3. Click **Propose to Major Security Incident**.

\[Omitted image "propos-msi.png"\] Alt text: Propose incident

4. On the form, fill in the fields such as Detection date, Justification, and Potential impact.

5. Click **Propose**.

The incident record is proposed as a major security incident candidate.

After the incident record is proposed as a major security incident candidate, **Major Security Incident Candidate** tag is applied and displayed on the security incident form banner.

**Note:** Click **Unlink from Major Security Incident** to unlink the incident if you don't wish to propose or doesn't have any critical impact. The incident will be unlinked and lists under the list view to the security analyst for remediation.

**Parent Topic:**[Working with MSI Records](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/working-with-msi-records.md)