> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/topic-classification.md). # Topic classification {% hint style="info" %} This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on. If you have the Endpoint DLP add-on, Data Classification is automatically available. {% endhint %} ## Overview Data security has traditionally relied on automated pattern detection to find sensitive information like credit card numbers. However, highly sensitive files, such as customer contracts or corporate strategies, can be easily misclassified if they lack those specific data patterns. The Topic Classification feature provides crucial context by automatically assigning a business-relevant topic to your files. This shifts your data security strategy from purely pattern-based detection to a holistic, context-driven approach, allowing you to accurately assess file sensitivity and apply the appropriate security controls. ## Scope and supported file types For this initial release, Topic Classification is available specifically for cloud data locations. {% hint style="info" %} **Note** SaaS and endpoint locations are not currently supported for topic scanning. On-premise files are displayed as **N/A** in the **Topic** column. {% endhint %} The feature applies to all unstructured textual files of these file types: * .pdf * .doc * .docx * .ppt * .pptx * .txt * .rtf ## Supported topics and profile mapping Each file is assigned a single, primary topic based on its content. To ensure you can easily manage risk, each topic is automatically mapped to a single data profile. | Topic | Descriptions | Mapped data profile | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | | Legal Agreements | Formal contracts and service terms between parties. These files define legal obligations related to business operations. | Sensitive | | CVs-Resumes of Potential Applicants | Professional profiles detailing candidate work history and qualifications. These documents contain personal information and are subject to privacy regulations. | PII | | Medical Certificates-Records | Private health information and clinical documentation for individuals. This sensitive data requires high-level protection to maintain patient confidentiality and regulatory compliance. | PHI | | Payroll & Transactions | Financial transaction records including invoices, receipts, and payment confirmations, as well as Employee compensation records including salary details, deductions, and payment history. | Financial | | Tax Documents | Tax filings, returns, and related financial documents. These contain sensitive financial data subject to regulatory requirements. | Financial | | Corporate Filings | Official corporate registration documents, annual reports, and regulatory filings. These records are essential for legal compliance and corporate governance. | Sensitive | | Business Continuity Plans | Business continuity and disaster recovery plans. These strategic documents outline procedures for maintaining operations during disruptions. | Sensitive | ## How scanning works To maximize efficiency and provide the most accurate risk assessment, file scanning follows a specific logic: * **Privacy:** The data never leaves the customer environment. The AI-based embedding model runs in the customer environment in same way as the data patterns are scanned. * **Pattern dependency:** A file is scanned for topics only if it has already been scanned for data patterns. Combining pattern data with business topics gives you a comprehensive view of a file's true risk level. * **Scanning cadence:** Files are scanned for topics at the same defined cadence of the data patterns. Because the core business topic of a file rarely changes without significant content alteration, this cadence ensures accuracy while remaining cost-effective. * **Rescanning:** Files are rescanned at the same defined cadence for data patterns, rendering the cost insignificant. ## Viewing topics in the platform Once a file is scanned, its assigned topic is visible across multiple areas of the platform. If Cortex Data Classification does not detect a supported topic, it is marked as "Not found." You can view, filter, and analyze topics in the following locations: * **File inventory:** A dedicated **Topics** column is located next to the data patterns and records columns. You can filter the inventory using the **Topics** list. * **File view:** A summary of discovered topics appears between the **Data Profiles** and **Data Patterns** sections. * **Asset inventory & asset page:** View a **Distribution by Topics** summary to see how many files within an asset belong to a specific topic. * **Overview map:** Filter the global map component by specific topics. * **AI dashboards:** View topic distributions for sensitive data used by AI, including model pages and datasets. * **Custom profiles:** You can use topics as a specific parameter (using AND/OR logic) when building custom profiles. ## Overriding classifications and false positives Administrators have the ability to manually override the assigned topic if it is inaccurate. * **Manual override:** Admins can change a file's topic to another supported topic or designate it as "File does not contain any supported topics." * **Persistent changes:** Once an admin overrides a topic, future quarterly scans will respect that user definition and will not revert the change. * **False positive (FP) reporting:** If you need to open a support case for a false positive, please attach the actual file because screenshots cannot be used for topic FP analysis. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-data-classification/topic-classification.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.