Systems and method classify a file using filters. A file event can be determined for the file. In response to the file event, metadata is received for the file. In response to receiving the metadata, a filter of a plurality of filters is selected based on the metadata. One or more rules in the selected filter can classify the file to determine an action to be performed with respect to the file.