Consider adding a FindSpec artifact definition

[joachimmetz]

Though most artifacts (so far) are path/file based it would be useful to be able to specify paths in a more flexible way similar to find specs (as provided in GRR and dfVFS).

[joachimmetz]

Maybe not an artifact type but a replacement / alternative for paths e.g. now

name: MacOSAppleSystemLogFiles
doc: Apple system log (ASL) files
sources:
- type: FILE
  attributes: {paths: ['/var/log/asl/*']}
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'

with find spec

name: MacOSAppleSystemLogFiles
doc: Apple system log (ASL) files
sources:
- type: FILE
  attributes:
    find_specs:
      - paths: ['/var/log/asl']
        filenames: ['*']
labels: [System, Logs]
supported_os: [Darwin]
urls:
- 'http://forensicswiki.org/wiki/Mac_OS_X'
- 'http://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location#System_Logs'

[joachimmetz]

Maybe instead of find_specs name this path_filters?