anchor.diff:    supported_os: [Linux]
   labels: [Browser]
   supported_os: [Windows, Linux, Darwin]
  ---------------------------------------------------------------------------------
  -
  -Files
  ------
  +----
  +
  +== Files
   
   Artifact filenames should be of the form file_name.yaml
   
   Each file should have a comment at the top of the file with a one-line summary
   of the artifacts contained in the file:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   # Windows specific artifacts.
  ---------------------------------------------------------------------------------
  -
  +----
  +
  
positive.code: Artifact YAML Style Guide
  =========================
  :toc:
  :toc-placement: preamble
  :icons:
  
  This style guide aims to ensure consistency and readbility for forensics
  artifacts defined in link:http://www.yaml.org/spec/1.2/spec.html[YAML].
  The format is currently under development and might undergo some
  change. Eventually this style should be enforced in code.
  
  The Basics
  ----------
  
  Here's a typical artifact definition:
  
  --------------------------------------------------------------------------------
  name: ApplicationEventLogEvtx
  doc: Windows Application Event Log for Vista or newer systems.
  collectors:
  
negative.code:   Ideally forensicswiki.org links.
  
  
  == Long docs
  
  Multi-line docs should use the Literal Style indicated by the |
  character with a double newline between the short description and the longer
  portion.  Explicit newlines (\n) should not be used:
  
  [source,yaml]
  ----
  doc: |
    Collect windows run keys.
  
    Note users.sid will currently only expand to SIDs with profiles on the system,
    not all SIDs.
  ----
  
  == Collectors
  
  The available collector types are defined in
  link:https://github.com/ForensicArtifacts/artifacts/blob/master/artifacts/definitions.py[definitions.py]
  