> Source: [sk184427](https://support.checkpoint.com/results/sk/sk184427)

# sk184427 - Data Loss Prevention does not block file uploads to grok.com

| Property | Value |
|----------|-------|
| Solution ID | sk184427 |
| Date Created | 2026-01-02 |
| Last Modified | 2026-01-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |
| Platform | 7000, 9000, Open Server, 6000 |

## Symptoms

- Data Loss Prevention (DLP) on a Quantum 9400 Security Gateway does not block file uploads to grok.com, while DLP blocks the uploads as expected on other websites (for example, dlptest.com).

The issue is observed under the following conditions:

* HTTPS Inspection is enabled and active for grok.com.
* No HTTPS Inspection or DLP bypass rules are configured for grok.com.
* DLP logs show Allow actions for file uploads to grok.com, but Prevent actions for the same files uploaded to other websites.
* Multiple file types (TXT, PDF, Excel, and others) are allowed on grok.com but blocked on other sites.
* No DLP Prevent logs appear in SmartConsole for uploads to grok.com, unless JSON is explicitly included in the DLP rule.
* DLP debug logs show different content types:
  * grok.com uploads use `Content-Type: application/json`
  * Other sites (for example, dlptest.com) use `Content-Type: multipart/form-data`
* Example logs:
`
  `
  * grok.com: Action: Allow, Content-Type: application/json
  * dlptest.com: Action: Prevent, Content-Type: multipart/form-data

## Cause

When uploading files to grok.com, the application sends the upload data with the content type `application/json`. As a result, DLP evaluates the traffic as JSON content rather than as the actual file type (for example, PDF or Excel).

If the DLP rule does not include `JSON -- JavaScript Object Notation` as a protected file type, DLP allows the upload and does not generate a Prevent log.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content