> Source: [sk184440](https://support.checkpoint.com/results/sk/sk184440)

# sk184440 - Data Loss Prevention does not block File Uploads to grok.com when Content-Type is application/json

| Property | Value |
|----------|-------|
| Solution ID | sk184440 |
| Date Created | 2025-12-25 |
| Last Modified | 2025-12-26 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20 |

## Symptoms

- * The DLP feature does not block file uploads (PDF, Excel, TXT) to grok.com, while uploads to other sites (e.g., dlptest.com) are blocked.
* The system does not generate DLP `Prevent` logs for grok.com uploads, but logs appear for other sites.
* Hypertext Transfer Protocol Secure (HTTPS) Inspection is enabled and confirmed working for grok.com.
* DLP debug logs show files uploaded to grok.com are allowed, even when rules are set to block such files.
* DLP logs indicate files uploaded to grok.com are detected as `application/json` instead of their native file type.   

  Example log output:   
  `DLP Log: File uploaded to grok.com detected as 'application/json' `  
  `
  DLP Log: No 'Prevent' action triggered for upload`

## Cause

grok.com sends uploaded files using the `application/json` content-type header. The DLP engine relies on this header to classify files. When the header is `application/json`, the engine treats the upload as a JavaScript Object Notation (JSON) object and does not match rules for native file types (PDF, Excel, TXT). This behavior is by design.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content