I,ve written a signature to match small iframes in http responses. This works fine and I get an entry in signatures.log and notice.log. I'd now like to extract any files which hit this sig so I can have a closer look. If I look at the signature_match event I can see the http content in the data variable - should I just output this data to a file or is there a way to use the file_extract functionality to extract the file correctly. I'd like to extend this with more sigs so the file extract is my preferred method. Should I be catching the sig_match event and then "call" file extract or catch the file_new event and somehow match the sig ? TIA
