> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md).

# Archive file classification

{% hint style="info" %}
**Note**:

Available from Cortex agent 9.3.
{% endhint %}

Archive file classification allows Cortex Data Loss Prevention (DLP) to inspect the contents of archive files (even if compressed). By applying your data-in-motion rules to the files inside, DLP ensures sensitive data remains protected even when packaged in an archive.

### **How it works**

* **Archive-Level Enforcement**: DLP evaluates the archive as a single entity. If any supported file within the archive matches a data profile in a data-in-motion rule, the rule's designated action (**Block**, **Report**, or **Allow**) is applied to the entire archive. Files inside the archive are not enforced individually.
* **Deep Inspection**: DLP inspects nested archives up to 50 levels deep. There is no limit on folder depth within the archive.
* **Unsupported Files**: Any files inside the archive that are not supported for classification are safely skipped and do not impact the overall result.

### **Supported archive formats**

Archive file classification supports common archive formats that vary between operating systems. For a complete list of supported file types, refer to the [Supported files](/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md#supported-file-types-and-extensions) documentation.

{% hint style="info" %}
**Note**:

Archive inspection is subject to standard file size constraints. The total archive size must remain within the maximum supported file size detailed in the Agent side limitations.
{% endhint %}

### **Partial classification**

Archives support partial classification. If DLP cannot fully scan an archive, for example, if the inspection times out, it will still enforce data-in-motion rules based on the contents it successfully classified.

* If a match is found in the scanned portion, DLP applies the matched main action.
* If no rule matches the scanned contents, DLP applies the default action defined in your endpoint DLP settings.
* If the archive is password-protected, it can still match data profiles that use the password-protected filter.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.