{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44678,"path":"security-management/security-incident-response/msim-checklist.md","title":"Checklist for MSIM setup","bundle":null,"doc_type":null,"release":"australia","body":"\n# Checklist for MSIM setup\n\nBefore using the ServiceNow® Major Security Incident Management \\(MSIM\\) application, download the application from the ServiceNow® Store.\n\nTrack your progress with the setup, installation, and configuration from the following table.\n\n**Note:** The roles assigned for Major Security Incident Management application are listed in the further following sections, for more information, see [Major Security Incident Management roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/msi-roles.md).\n\nUse the following checklist to guide you through the end-to-end steps to install and configure Major Security Incident Management application.\n\n\n
\n\nSetup task\n\n\n\nDescription\n\n
\n\nVerify that the Major Security Incident Management application is installed and activated from the ServiceNow® Store.\n\n\n\nMajor Security Incident Management v1.1.1 is available on ServiceNow® Store.\n\n Follow these instructions: [downloading an application from the ServiceNow Store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/download-app-first-time.md).\n\n
\n\nVerify that the following applications are installed in the given order.\n\n\n\nThe following applications will be installed by default after you install Major Security Incident Management application in the current application release version:- File Explorer Core for Security Operations v1.1.1\n- Microsoft SharePoint File Explorer Connector for Security Operations v1.1.1\n- File Explorer Component for Security Operations v1.0.0\n- Microsoft Teams Chat Connector for Security Operations v1.0.0\n- Chat core for Security Operations v1.0.0\n- Major Security Incident Response v1.1.1\n- Collab Chat EVAM card for MSIM workspace v1.0.0 \\(This application is set up only for the UI visualizations in the application background for Major Security Incident Management workspace\\)\n- Task Organizer UI Component for Major Security Incident Management workspace 1.0.0\n- Security Incident Response v12.8.1\n\n
\n\nVerify that the user roles are assigned to Major Security Incident as appropriate.\n\n\n\nThe following roles are involved throughout the incident life-cycle of Major Security Incident remediation process:- MSI Administrator \\[sn\\_msi.workspace\\_admin\\]\n- MSI Manager \\[sn\\_msi.workspace\\_manager\\]\n- MSI Responder \\[sn\\_msi.workspace\\_responder\\]\n\nFor more detailed information on each role, see [Major Security Incident Management roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/msi-roles.md).\n\n
\n\nVerify that you have successfully setup Microsoft SharePoint v1.0.0 configuration.\n\n\n\nMicrosoft SharePoint manages sites, folders, files, groups, and users in Microsoft SharePoint.\n\n Add Microsoft SharePoint data to your ServiceNow® instance. To do this you must setup Graph and Rest connections.\n\n For information, see [Microsoft SharePoint spoke v1.1.2](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/sharepoint-online-spoke.md) documentation on how to setup REST and Graph connections Configuration.\n\n Establish Graph and REST connection to connect to your ServiceNow® instance from Microsoft SharePoint.\n\n
\n\nVerify that you have created a Microsoft SharePoint site to create a document library.\n\n\n\nCreate a Microsoft SharePoint site, if required or you can use an existing site to create the document library.\n\n
\n\nVerify that you have created a document library under the Microsoft SharePoint site.\n\n\n\nCreate a dedicated document library under a new or existing Microsoft SharePoint site.\n\n
\n\nVerify that required permissions are provided to the users and assigned to the required user groups in the Microsoft SharePoint.\n\n\n\nManage access from Microsoft SharePoint site to different users and user groups.\n\n
\n\nVerify that you have created and configured Microsoft SharePoint Drive and necessary configuration settings.\n\n\n\nTo verify the drive configurations, setup Microsoft SharePoint File Explorer Connector, Folder, and File Actions and Folder Templates:\n\n- [Configure File Explorer repository drive](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/file-explorer-repository-config.md): Create connection from Microsoft SharePoint to ServiceNow® instance.\n- [Configure Folder and File Action Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/folder-file-action-settings.md): Configure and control the individual Folder and File Actions displayed on the File Explorer Component.\n- [Create Folder Templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/file-explorer-folder-templates.md): Configure to create unique folders for different Major Security Incident types.\n\n
\n\nVerify that you have successfully established a connection to Microsoft Teams Chat Connector application.\n\n\n\nTo establish Microsoft Teams Chat Connector application connection with ServiceNow® instance, follow the procedure explained here: [Establish MS Teams Graph connection on ServiceNow AI Platform](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/msim-micorsoft-team-requirements.md).\n\n
\n\nVerify that you have configured Microsoft teams with ServiceNow AI Platform® instance and created connections and credentials configurations.\n\n\n\nTo verify Microsoft Teams configuration with ServiceNow® instance, follow the procedure as explained here:\n\n- [Establish MS Teams Graph connection on ServiceNow AI Platform](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/msim-micorsoft-team-requirements.md)\n- [Create a chat channel template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/create-chat-channel-template-for-msim.md)\n\n
\n\nVerify that the Major Security Incident Administration - Configuration settings are successful.\n\n\n\nAs an MSI Administrator, you must be able to:\n\n- Determine whether security analysts can propose and promote the incident and link other security incidents.\n- Enable or disable the notifications when an incident is proposed or promoted. Ability to edit default template messages.\n- Configure security tags that appear on the security analyst interface to differentiate the incidents that have been proposed as a major security incident candidate or promoted to a major security incident.\n\n
\n\nVerify that the Major Security Incident Administration - Notifications settings are successful.\n\n\n\nAs an MSI Administrator, trigger email notifications when a security incident is proposed and are sent to all those users and groups who are configured to the notifications list. For more information, see [Set notification preferences for MSIM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/configuring-msi-administration-settings.md).\n\n
\n\nVerify that the SI to MSI Promotion Flow Designer flows are copied and activated.\n\n\n\nBoth the **SI to MSI Promotion \\(SharePoint\\)** and **SI to MSI Promotion \\(Teams\\)** flows must be copied and activated independently. If only one flow is active, only the corresponding component \\(File Explorer or Chat\\) is set up when a security incident is promoted.\n\n
**Parent Topic:**[Exploring Major Security Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/exploring-major-security-incident-management.md)\n\n**Related topics** \n\n\n[Major Security Incident Management]()\n\n[Get started with MSIM]()\n\n[Major Security Incident Management roles]()\n\n[Environment reference for MSIM setup]()\n\n"}}