anchor.diff: -Artifact YAML Style Guide
  -=========================
  += Artifact YAML Style Guide
  +
   :toc:
   :toc-placement: preamble
   :icons:
   
  +[NOTE]
   This style guide aims to ensure consistency and readbility for forensics
   artifacts defined in link:http://www.yaml.org/spec/1.2/spec.html[YAML].
   The format is currently under development and might undergo some
   change. Eventually this style should be enforced in code.
   
  -The Basics
  -----------
  +== The Basics
   
   Here's a typical artifact definition:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   name: ApplicationEventLogEvtx
   doc: Windows Application Event Log for Vista or newer systems.
   collectors:
  
positive.code: labels: [Logs]
  supported_os: [Windows]
  urls: ['http://www.forensicswiki.org/wiki/Windows_XML_Event_Log_(EVTX)']
  --------------------------------------------------------------------------------
  
  - *name*: CamelCase name without spaces.
  - *doc*: First line is a short description of the artifact, mentioning
  
negative.code: Since OS conditions are a very common constraint, this has been provided as a
  separate option "supported_os" to simplify syntax.  Under the hood, this:
  
  [source,yaml]
  ----
  supported_os: [Windows, Linux, Darwin]
  ----
  
  is translated to objectfilter as:
  
  [source,yaml]
  ----
  ["os =='Windows'" OR "os=='Linux'" OR "os == 'Darwin'"]
  ----
  
  supported_os should be used when specifying os conditions, no quotes are
  required.  Single quotes should be used for strings when writing conditions.
  
  [source,yaml]
  ----
  conditions: [os_major_version >= 6 and time_zone == 'America/Los_Angeles']
  ----
  
  == Minimize the Number of Definitions by Using Multiple Collectors
  
  To minimize the number of artifacts in the list, combine them using the
  supported_os and conditions attributes where it makes sense. e.g. rather than
  having FirefoxHistoryWindows, FirefoxHistoryLinux, FirefoxHistoryDarwin, do:
  
  [source,yaml]
  ----
  name: FirefoxHistory
  doc: Firefox places.sqlite files.
  collectors:
  