anchor.diff:  - *doc*: First line is a short description of the artifact, mentioning
     important caveats.  If more description is necessary, use the
     link:#long-docs[long form].
  -- *collectors*: List of collectors and necessary arguments.  This is the key
  +- *sources*: List of sources and necessary arguments.  This is the key
     part of the artifact that describes the data on the client. See
  -  link:#collectors[the Collectors section] for more details.
  +  link:#sources[the Sources section] for more details.
   - *conditions*: Conditions that will apply to this artifact. See
     link:#conditions[the Conditions section] for more details.
   - *labels*: List of labels.  Labels are used to logically group artifacts into
  
positive.code: ----
  name: ApplicationEventLogEvtx
  doc: Windows Application Event Log for Vista or newer systems.
  collectors:
  - collector_type: FILE
    args:
      path_list:
        - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
  conditions: [os_major_version >= 6]
  
negative.code: ----
  name: FirefoxHistory
  doc: Firefox places.sqlite files.
  sources:
  - type: FILE
    attributes:
      path_list:
        - %%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
        - %%users.appdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
    supported_os: [Windows]
  - type: FILE
    attributes:
      path_list: [%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite]
    supported_os: [Darwin]
  - type: FILE
    attributes:
      path_list: ['%%users.homedir%%/.mozilla/firefox/*/places.sqlite']
    supported_os: [Linux]
  labels: [Browser]
  