classes:
  - class: Summary
    subclasses:
      - class: Files
        attributes:
          path: '%Profile%\Downloads'
          flags: [include_subdirectory]
        condition: os_version >= 6
      - class: Tasks
        subclasses:
          - class: Tasks.Processes
          - class: Tasks.Modules
          - class: Tasks.Services
      - class: Hardware
        subclasses:
          - class: Hardware.Devices
          - class: Hardware.Processors
          - class: Hardware.Mainboard

files:
  # SystemEventLog
  - paths: ['%System%\winevt\Logs\System.evtx']
    condition: os_version >= 6
  - paths: ['%System%\winevt\Logs\SysEvent.evt']
    condition: os_version < 6