1. One or more non-transitory computer readable media that include code for execution and when executed by one or more processors is operable to perform operations comprising: receiving a content tag associated with transferring a first file over a network connection from a host, wherein the content tag indicates a classification of content in a second file, and wherein the first file and the second file were used on the host during a same session; correlating the content tag with a network policy; and applying the network policy to the network connection.