anchor.diff:  pieces of information that include items such as logs, configured services, cron
   jobs, patch state, user accounts, and much more.  These pieces of information
   are known as forensic artifacts, and their location and format vary drastically
  -across systems.  We have built a framework to describe forensic artifacts that
  -allows them to be collected and customised quickly using GRR.
  -link:https://code.google.com/p/grr/source/browse/artifacts[The collection of
  -artifacts] is intended to be a centralized, free, community sourced, knowledge
  -base of forensic artifacts that the world can use both as an information source
  -and within other tools.
  +across systems.
  +
  +We have built a framework to describe forensic artifacts that allows them to be collected and customised quickly using GRR.  This collection was initially contained inside the GRR repository, but we have now moved it out to link:https://github.com/ForensicArtifacts/artifacts[a separate repository] to make access simple for other tools.
   
   The goals of the GRR artifacts implementation are:
   
  
positive.code: Defining New Artifacts
  ~~~~~~~~~~~~~~~~~~~~~~
  
  New artifacts can be added to the link:https://code.google.com/p/grr/source/browse/artifacts[grr/artifacts] directory, which will be
  imported on server restart.  Artifacts can also be uploaded via the Artifact
  Manager gui and used immediately without the need for a restart.
  
  GRR's FUSE layer
  ----------------
  
negative.code:     collect them immediately.
  
  GRR artifacts are defined in YAML, with a style guide
  link:https://github.com/ForensicArtifacts/artifacts/blob/master/docs/style_guide.adoc[available here].  We use a standard set of machine information collected from the host for variable interpolation.  This collection
  of data is called the Knowledge Base (see link:https://github.com/google/grr/blob/master/proto/knowledge_base.proto[proto/knowledge_base.proto])
  and is referenced with a %%variable%% syntax.
  
  The artifact defines where the data lives.  Once it is retrieved by GRR a
  link:https://github.com/google/grr/tree/master/parsers[parser] can optionally
  be applied to turn the collected information into a more useful format, such as
  parsing a browser history file to produce URLs.
  
  