anchor.diff:  ----
   name: ApplicationEventLogEvtx
   doc: Windows Application Event Log for Vista or newer systems.
  -collectors:
  -- collector_type: FILE
  -  args:
  +sources:
  +- type: FILE
  +  attributes:
       path_list:
         - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
   conditions: [os_major_version >= 6]
  
positive.code: [source,yaml]
  ----
  doc: |
    Collect windows run keys.
  
    Note users.sid will currently only expand to SIDs with profiles on the system,
    not all SIDs.
  ----
  
  == Collectors
  
  The available collector types are defined in
  link:https://github.com/ForensicArtifacts/artifacts/blob/master/artifacts/definitions.py[definitions.py]
  as TYPE_INDICATOR constants.
  
  Where collectors take a single argument with a single value, the {} form should
  be used to save on line breaks:
  
  [source,yaml]
  ----
  collectors:
  - collector_type: FILE
    args: {path_list: [/var/log/wtmp]}
  ----
  
  Where there are multiple arguments, or the arguments have multiple values, the
  
negative.code: conditions: [os_major_version >= 6 and time_zone == 'America/Los_Angeles']
  ----
  
  == Minimize the Number of Definitions by Using Multiple Sources
  
  To minimize the number of artifacts in the list, combine them using the
  supported_os and conditions attributes where it makes sense. e.g. rather than
  