Which Cisco AMP for endpoints feature is used during post-incident investigations to determine the source (patient zero) of the malware?

Which Cisco AMP for endpoints feature is used during post-incident investigations to determine the source (patient zero) of the malware?
A. file security intelligence feeds
B. file capture
C. file sandboxing
D. file trajectory