Which Action Should You Take When Cisco Threat Response Notifies

Which action should you take when Cisco Threat Response notifies you that AMP has identified a file as malware?

A) Add the malicious file to the block list.
B) Send a snapshot to Cisco for technical support.
C) Forward the result of the investigation to an external threat-analysis engine.
D) Wait for Cisco Threat Response to automatically block the malware.