When creating a new CloudSOC Protect policy type "Data Transfer via Gatelets"
Data Transfer Type - "Messages" is not selectable with exclamation point in a triangle.
Cause
There needs to be GW Message events in order to enable this Protect Policy option
Resolution
Enable MS Teams Gatelet in CloudSOC Store
Wait 2-3 min for sync to Cloud SWG tenant
Confirm MS Teams now showing in SWG / CloudSOC Gatelets
In Cloud SWG / Agents, or on Agent on PC click “Reconnect” – to sync changes. Or reboot PC
On same PC - Login to MS Teams - send a test message.
In CloudSOC Investigate – confirm that MS Teams test message GW event was captured
"Messages" option in Protect / Policy / Data Transfer via Gatelets is now available.
Note: MS Teams App is just an example of an APP that will have "message" activities / events.
There may be other Apps with messaging capability that could be enabled instead
Additional Information
If MS Teams not in use - can follow same sequence substituting a different messaging App such as Slack, Google Chat, etc. - enabling it's associated Gatelet first.