Set up the configuration for the pipeline through which Trellix is alerted that messages have been received and downloads them. This involves creating a topic, the publish side of the pub/sub.
To create a topic:
Follow steps 1-3 under "Create a topic" in the Google documentation.
Unselect Add a default subscription.
Click Create.
Make note of your topic name for later use.
Note
It is not necessary to set up a subscription object (the sub portion of the pub/sub configuration); Trellix uses the rights granted to the service account to create the subscription for you.
Next, grant permissions to publish to and edit your topic. This is done from the Topics page (the page you're directed to after your topic is created).
To assign permissions to a topic:
Select the box to the left of the name of the topic you just created.
In the right-hand pane, click Add principal.
In the New principals box, enter "gmail-api-push@system.gserviceaccount.com"
Click the Select a role drop-down, then hover over Pub/Sub in the left-hand pane.
In the right-hand pane, click Pub/Sub Publisher.
Click Save.
Click Add Principal to add the next principal.
In the New principals box, enter the email address you entered earlier for the service account.
Click the Select a role drop-down, then hover over Pub/Sub in the left-hand pane. Select Pub/Sub Editor.
Click Save.
In the right-hand pane, expand the Owner role / principal.
Make note of the email address listed. The owner of the topic will be used as the admin email in the Email Security - Cloud authorization configuration later on.
Note
If you want to use a different user for creating/owning your subscriptions, change the owner to the user that you want to create your subscription objects.