Which FireAMP capability can tell you how malware has spread in a network?

Which FireAMP capability can tell you how malware has spread in a network?
A. File Analysis
B. Threat Root Cause
C. File Trajectory
D. Heat Map