anchor.diff:  name: ApplicationEventLogEvtx
   doc: Windows Application Event Log for Vista or newer systems.
   collectors:
  -- action: GetFiles
  +- collector_type: FILE
     args:
       path_list:
         - '%%environ_systemroot%%\System32\winevt\Logs\Application.evtx'
  
positive.code: 
  --------------------------------------------------------------------------------
  collectors:
  - action: RunCommand
    args:
      args: [-qa]
      cmd: /bin/rpm
  --------------------------------------------------------------------------------
  --------------------------------------------------------------------------------
  collectors:
  - action: GetFiles
    args:
      path_list:
        - /root/.bashrc
  
negative.code: name: FirefoxHistory
  doc: Firefox places.sqlite files.
  collectors:
  - collector_type: FILE
    args:
      path_list:
        - %%users.localappdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
        - %%users.appdata%%\Mozilla\Firefox\Profiles\*\places.sqlite
    supported_os: [Windows]
  - collector_type: FILE
    args:
      path_list: [%%users.homedir%%/Library/Application Support/Firefox/Profiles/*/places.sqlite]
    supported_os: [Darwin]
  - collector_type: FILE
    args:
      path_list: ['%%users.homedir%%/.mozilla/firefox/*/places.sqlite']
    supported_os: [Linux]
  