Distributing processing and storage across multiple physical locations or logical domains provides a degree of redundancy or overlap for organizations. The redundancy and overlap increase the work factor of adversaries to adversely impact organizational operations, assets, and individuals. The use of distributed processing and storage does not assume a single primary processing or storage location. Therefore, it allows for parallel processing and storage.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| SC-36 | Distributed Processing and Storage | Protects | T1070.002 | Clear Linux or Mac System Logs |
| SC-36 | Distributed Processing and Storage | Protects | T1119 | Automated Collection |
| SC-36 | Distributed Processing and Storage | Protects | T1565 | Data Manipulation |
| SC-36 | Distributed Processing and Storage | Protects | T1565.001 | Stored Data Manipulation |
| SC-36 | Distributed Processing and Storage | Protects | T1070.001 | Clear Windows Event Logs |
| SC-36 | Distributed Processing and Storage | Protects | T1070 | Indicator Removal |
| SC-36 | Distributed Processing and Storage | Protects | T1070.008 | Clear Mailbox Data |