<div dir="ltr">No, you can't get the filename, because content such as http streams may not have a filename whatsoever. If the name of the file is being dictated by the user when a link or the like is clicked (via http for example), there is no associated metadata for which it can be determined. Bro can do this to a degree, so you may want to look at that to supplement your suri coverage.<br><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 27, 2017 at 12:00 PM,  <span dir="ltr"><<a href="mailto:oisf-users-request@lists.openinfosecfoundation.org" target="_blank">oisf-users-request@lists.openinfosecfoundation.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send Oisf-users mailing list submissions to<br>
        <a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
        <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
        <a href="mailto:oisf-users-request@lists.openinfosecfoundation.org">oisf-users-request@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
You can reach the person managing the list at<br>
        <a href="mailto:oisf-users-owner@lists.openinfosecfoundation.org">oisf-users-owner@lists.<wbr>openinfosecfoundation.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
   1. File extraction - keep file name/extension? (Brian Hennigar)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Tue, 27 Jun 2017 11:53:43 -0300<br>
From: Brian Hennigar <<a href="mailto:bhennigar@gmail.com">bhennigar@gmail.com</a>><br>
To: "<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a>"<br>
        <<a href="mailto:oisf-users@lists.openinfosecfoundation.org">oisf-users@lists.<wbr>openinfosecfoundation.org</a>><br>
Subject: [Oisf-users] File extraction - keep file name/extension?<br>
Message-ID:<br>
        <<a href="mailto:CAOLP4yopMHsTvJrtEtOabQZhr_u73oyH1j3XP6znOijuu68CJA@mail.gmail.com">CAOLP4yopMHsTvJrtEtOabQZhr_<wbr>u73oyH1j3XP6znOijuu68CJA@mail.<wbr>gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hi,<br>
<br>
When using file extraction, is it possible to keep the original file name<br>
instead of file.<id> and file.<id>.meta?   Or to avoid having files with<br>
the same name, something like file.<id>.extension<br>
<br>
<br>
<br>
Thanks,<br>
Brian<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170627/c08bbbe9/attachment-0001.html" rel="noreferrer" target="_blank">http://lists.<wbr>openinfosecfoundation.org/<wbr>pipermail/oisf-users/<wbr>attachments/20170627/c08bbbe9/<wbr>attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
______________________________<wbr>_________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@lists.openinfosecfoundation.org">Oisf-users@lists.<wbr>openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.<wbr>openinfosecfoundation.org/<wbr>mailman/listinfo/oisf-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Oisf-users Digest, Vol 91, Issue 19<br>
******************************<wbr>************<br>
</blockquote></div><br></div>