Topic classification ↗

Requires a Cloud Posture Security, Cloud Runtime Security, or Cortex XSIAM Premium license. If you have the Endpoint DLP add-on, Data Classification is automatically available.

Overview

Data security has traditionally relied on automated pattern detection to find sensitive information like credit card numbers. However, highly sensitive files, such as customer contracts or corporate strategies, can be easily misclassified if they lack those specific data patterns.

The Topic Classification feature provides crucial context by automatically assigning a business-relevant topic to your files. This shifts your data security strategy from purely pattern-based detection to a holistic, context-driven approach, allowing you to accurately assess file sensitivity and apply the appropriate security controls.

Scope and supported file types

For this initial release, Topic Classification is available specifically for cloud data locations.

Note

SaaS and endpoint locations are not currently supported for topic scanning. On-premise files are displayed as N/A in the Topic column.

The feature applies to all unstructured textual files of these file types:

  • .pdf
  • .doc
  • .docx
  • .ppt
  • .pptx
  • .txt
  • .rtf

Supported topics and profile mapping

Each file is assigned a single, primary topic based on its content. To ensure you can easily manage risk, each topic is automatically mapped to a single data profile.

Topic Descriptions Mapped data profile
Legal Agreements Formal contracts and service terms between parties. These files define legal obligations related to business operations. Sensitive
CVs-Resumes of Potential Applicants Professional profiles detailing candidate work history and qualifications. These documents contain personal information and are subject to privacy regulations. PII
Medical Certificates-Records Private health information and clinical documentation for individuals. This sensitive data requires high-level protection to maintain patient confidentiality and regulatory compliance. PHI
Payroll & Transactions Financial transaction records including invoices, receipts, and payment confirmations, as well as Employee compensation records including salary details, deductions, and payment history. Financial
Tax Documents Tax filings, returns, and related financial documents. These contain sensitive financial data subject to regulatory requirements. Financial
Corporate Filings Official corporate registration documents, annual reports, and regulatory filings. These records are essential for legal compliance and corporate governance. Sensitive
Business Continuity Plans Business continuity and disaster recovery plans. These strategic documents outline procedures for maintaining operations during disruptions. Sensitive

How scanning works

To maximize efficiency and provide the most accurate risk assessment, file scanning follows a specific logic:

  • Privacy: The data never leaves the customer environment. The AI-based embedding model runs in the customer environment in the same way as the data patterns are scanned.
  • Pattern dependency: A file is scanned for topics only if it has already been scanned for data patterns. Combining pattern data with business topics gives you a comprehensive view of a file's true risk level.
  • Scanning cadence: Files are scanned for topics at the same defined cadence of the data patterns. Because the core business topic of a file rarely changes without significant content alteration, this cadence ensures accuracy while remaining cost-effective.
  • Rescanning: Files are rescanned at the same defined cadence for data patterns, rendering the cost insignificant.

Viewing topics in the platform

Once a file is scanned, its assigned topic is visible across multiple areas of the platform. If Cortex Data Classification does not detect a supported topic, it is marked as "Not found."

You can view, filter, and analyze topics in the following locations:

  • File inventory: A dedicated Topics column is located next to the data patterns and records columns. You can filter the inventory using the Topics list.
  • File view: A summary of discovered topics appears between the Data Profiles and Data Patterns sections.
  • Asset inventory & asset page: View a Distribution by Topics summary to see how many files within an asset belong to a specific topic.
  • Overview map: Filter the global map component by specific topics.
  • AI dashboards: View topic distributions for sensitive data used by AI, including model pages and datasets.
  • Custom profiles: You can use topics as a specific parameter (using AND/OR logic) when building custom profiles.

Overriding classifications and false positives

Administrators have the ability to manually override the assigned topic if it is inaccurate.

  • Manual override: Admins can change a file's topic to another supported topic or designate it as "File does not contain any supported topics."
  • Persistent changes: Once an admin overrides a topic, future quarterly scans will respect that user definition and will not revert the change.
  • False positive (FP) reporting: If you need to open a support case for a false positive, please attach the actual file because screenshots cannot be used for topic FP analysis.