Pub/sub Feed configuration

[keso]

Hello! when configuring a pub/sub push feed [1], could the push subscription be located in a different GCP project where Chronicle is running?

And, when configuring the push subscription and as it says in [2]:

"Select Enable authentication, and select a service account."

Which service account does Chronicle use? where can I find it?

(when using Google Cloud Storage it gives the possibility to configure a service account but not when using pub/sub, as shown in the following images: 

Thank you!

[1] https://cloud.google.com/chronicle/docs/administration/feed-management#pubsub-push-create

[2] https://cloud.google.com/chronicle/docs/administration/feed-management#specify-url-pubsub

[hzmndt · Accepted solution]

For pub/sub,  the endpoint is created in the BYOP project which the SIEM configured, when you enable the authentication, it will ask you to select the service accounts, there is dropdown you can select.