anchor.diff:  name: FirefoxHistory
   doc: Firefox places.sqlite files.
   collectors:
  -- action: GetFiles
  +- collector_type: FILE
     args:
       path_list:
         - %%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
         - %%users.appdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
     supported_os: [Windows]
  -- action: GetFiles
  +- collector_type: FILE
     args:
       path_list: [%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite]
     supported_os: [Darwin]
  -- action: GetFiles
  +- collector_type: FILE
     args:
       path_list: ['%%users.homedir%%/.mozilla/firefox/*/places.sqlite']
     supported_os: [Linux]
  
positive.code: - *doc*: First line is a short description of the artifact, mentioning
    important caveats.  If more description is necessary, use the
    link:#long-docs[long form].
  - *collectors*: List of collectors and necessary arguments.  This describes
    how GRR should collect the artifact from the client. See link:#collectors[the
    Collectors section] for more details.
  - *conditions*: Conditions that will apply to this artifact.
  - *labels*: List of labels.  Labels are used to logically group artifacts into
  
negative.code: name: ApplicationEventLogEvtx
  doc: Windows Application Event Log for Vista or newer systems.
  collectors:
  - collector_type: FILE
    args:
      path_list:
        - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
  