anchor.diff:  name: ApplicationEventLogEvtx
   doc: Windows Application Event Log for Vista or newer systems.
   collectors:
  -- action: GetFiles
  +- collector_type: FILE
     args:
       path_list:
         - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
  
positive.code: Collectors
  ----------
  
  The available collector actions are defined in lib.artifact_lib.ACTIONS_MAP and
  correspond to GRR flows.
  
  Where collectors take a single argument with a single value, the {} form should
  be used to save on line breaks:
  
  --------------------------------------------------------------------------------
  collectors:
  - action: GetFiles
    args: {path_list: [/var/log/wtmp]}
  --------------------------------------------------------------------------------
  
  
negative.code: Artifact conditions are implemented using the
  link:https://code.google.com/p/objectfilter/[objectfilter] system that allows
  you to apply complex conditions to the attributes of an object. Artifacts can
  apply conditions to any of the Knowledge Base object attributes as defined in
  link:https://code.google.com/p/grr/source/browse/proto/knowledge_base.proto[knowledge_base.proto].
  
  Since OS conditions are a very common constraint, this has been provided as a
  separate option "supported_os" to simplify syntax.  Under the hood, this:
  