Assign roles to ensure that users can perform all necessary actions within the MSIM application.

Table 1. Roles for Major Incident Management
Role Type Role Description
MSI Administrator sn_msi.workspace_admin Can I install and configure Major Incident Management and set up the dependent applications such as File Explorer (FE), Microsoft Teams and Chat Channel configuration, Workspace setup, and MSI Administration: Configurations and Notifications setup.

How to set up:

  • File Explorer (FE) component:
    • Configure file repository.
    • Configure file and folder actions, which are provided on the File Explorer component of the Collaboration tab in the Major Security Incident Management workspace.
    • Create the root folders and subfolders, and provide access to the subfolders.
  • Chat channel management
    • Activate and configure Microsoft Teams by validating Microsoft Teams connection.
    • Create chat teams and chat channels, and add users and assign users to the various user groups.
  • MSI Administration:
    • Configurations: Configure the security analysts actions, notifications sent when incidents are proposed and promoted, and display tags for the security incidents.
    • Notifications: Automate email notification process and user notifications when a security incident is either proposed or promoted as a major security incident.
MSI Manager sn_msi.workspace_manager
  • View access to the major security incident management configuration settings page. Restricted from modifying any of the configuration settings.
  • View and edit incident record data in the Details, Collaboration, and Task Organizer tabs of the Major Incident Management workspace.
  • Promote the security incident to a major security incident.
  • Configure file and folders actions available on the File Explorer component on the Collaboration tab of the Major Incident Management workspace.
  • Linking and unlinking additional records to Major Security Incidents from the workspace.
MSI Responder sn_msi.workspace_responder
  • Optional role to view, edit, and respond to major security incidents in the Details and Tasks tabs of the Major Incident Management workspace.
  • Linking and unlinking additional records to Major Security Incidents from the workspace.