> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md). # Archive file classification Learn how Cortex XDR classifies archive files for Endpoint DLP. {% hint style="info" %} **Note**: Available from Cortex agent 9.3. {% endhint %} Archive file classification allows Cortex Data Loss Prevention (DLP) to inspect the contents of archive files (even if compressed). By applying your data-in-motion rules to the files inside, DLP ensures sensitive data remains protected even when packaged in an archive. ### **How it works** * **Archive-Level Enforcement**: DLP evaluates the archive as a single entity. If any supported file within the archive matches a data profile in a data-in-motion rule, the rule's designated action (**Block**, **Report**, or **Allow**) is applied to the entire archive. Files inside the archive are not enforced individually. * **Deep Inspection**: DLP inspects nested archives up to 50 levels deep. There is no limit on folder depth within the archive. * **Unsupported Files**: Any files inside the archive that are not supported for classification are safely skipped and do not impact the overall result. ### **Supported archive formats** Archive file classification supports common archive formats that vary between operating systems. For a complete list of supported file types, refer to the [Supported files](/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview.md#supported-file-types-and-extensions) documentation. {% hint style="info" %} **Note**: Archive inspection is subject to standard file size constraints. The total archive size must remain within the maximum supported file size detailed in the Agent side limitations. {% endhint %} ### **Partial classification** Archives support partial classification. If DLP cannot fully scan an archive, for example, if the inspection times out, it will still enforce data-in-motion rules based on the contents it successfully classified. * If a match is found in the scanned portion, DLP applies the matched main action. * If no rule matches the scanned contents, DLP applies the default action defined in your endpoint DLP settings. * If the archive is password-protected, it can still match data profiles that use the password-protected filter. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/cortex-data-loss-prevention-dlp-module-overview/archive-file-classification.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.