anchor.diff:  Since OS conditions are a very common constraint, this has been provided as a
   separate option "supported_os" to simplify syntax.  Under the hood, this:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   supported_os: [Windows, Linux, Darwin]
  ---------------------------------------------------------------------------------
  +----
   
   is translated to objectfilter as:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   ["os =='Windows'" OR "os=='Linux'" OR "os == 'Darwin'"]
  ---------------------------------------------------------------------------------
  +----
   
   supported_os should be used when specifying os conditions, no quotes are
   required.  Single quotes should be used for strings when writing conditions.
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   conditions: [os_major_version >= 6 and time_zone == 'America/Los_Angeles']
  ---------------------------------------------------------------------------------
  -
  -Minimize the Number of Definitions by Using Multiple Collectors
  ----------------------------------------------------------------
  +----
  +
  +== Minimize the Number of Definitions by Using Multiple Collectors
   
   To minimize the number of artifacts in the list, combine them using the
   supported_os and conditions attributes where it makes sense. e.g. rather than
   having FirefoxHistoryWindows, FirefoxHistoryLinux, FirefoxHistoryDarwin, do:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   name: FirefoxHistory
   doc: Firefox places.sqlite files.
   collectors:
  
positive.code: Where collectors take a single argument with a single value, the {} form should
  be used to save on line breaks:
  
  --------------------------------------------------------------------------------
  collectors:
  - collector_type: FILE
    args: {path_list: [/var/log/wtmp]}
  --------------------------------------------------------------------------------
  
  Where there are multiple arguments, or the arguments have multiple values, the
  longer form should be used:
  
  --------------------------------------------------------------------------------
  collectors:
  - collector_type: COMMAND
    args:
      args: [-qa]
      cmd: /bin/rpm
  --------------------------------------------------------------------------------
  --------------------------------------------------------------------------------
  collectors:
  - collector_type: FILE
    args:
  
negative.code: = Artifact YAML Style Guide
  
  :toc:
  :toc-placement: preamble
  :icons:
  
  [NOTE]
  This style guide aims to ensure consistency and readbility for forensics
  artifacts defined in link:http://www.yaml.org/spec/1.2/spec.html[YAML].
  The format is currently under development and might undergo some
  change. Eventually this style should be enforced in code.
  
  == The Basics
  
  Here's a typical artifact definition:
  
  [source,yaml]
  ----
  name: ApplicationEventLogEvtx
  doc: Windows Application Event Log for Vista or newer systems.
  collectors:
  