Custom clauses allow an administrator to express the event conditions that a Cisco Secure Workload forensic rule must match, so A is correct. A rule combines a forensic event type with optional attributes, comparison operators, actions, and severity. Cisco’s Secure Workload forensic-events guide instructs administrators to create a rule and enter its clause, and it explains that the feature applies user-defined rules to captured real-time events. Secure Workload also supplies default product rules and MITRE ATT & CK rules, but those are predefined examples rather than the capability used to configure an administrator’s own logic. “Windows or Linux application” describes neither a rule-building mechanism nor a valid clause type. Therefore, custom clauses provide the required configurable forensic detection capability.

================