anchor.diff:  ----
   name: ApplicationEventLogEvtx
   doc: Windows Application Event Log for Vista or newer systems.
  -collectors:
  -- collector_type: FILE
  -  args:
  +sources:
  +- type: FILE
  +  attributes:
       path_list:
         - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
   conditions: [os_major_version >= 6]
  
positive.code: - *doc*: First line is a short description of the artifact, mentioning
    important caveats.  If more description is necessary, use the
    link:#long-docs[long form].
  - *collectors*: List of collectors and necessary arguments.  This is the key
    part of the artifact that describes the data on the client. See
    link:#collectors[the Collectors section] for more details.
  - *conditions*: Conditions that will apply to this artifact. See
    link:#conditions[the Conditions section] for more details.
  - *labels*: List of labels.  Labels are used to logically group artifacts into
  
negative.code: 
  [source,yaml]
  ----
  sources:
  - type: COMMAND
    attributes:
      args: [-qa]
      cmd: /bin/rpm
  ----
  [source,yaml]
  ----
  sources:
  - type: FILE
    attributes:
      path_list:
        - /root/.bashrc
        - /root/.cshrc
  