The capture .cap files are written to the "C:\Documents and Settings\All Users\Application Data\McAfee\Host Intrusion Prevention\McAfee Fire Saved Events\" or "C:\ProgramData\McAfee\Host Intrusion Prevention\McAfee Fire Saved Events\" directory.
The popup will occur for Host IPS signatures (I could not get the popup to work for a Network IPS signature (which is what would create the capture file)).
I thought that I should be able to right clic on an event in the HIPS GUI to directly get the .cap file. Maybe the french traduction was misleading. Since you told me the path to find those file the problem is solved.
Thank you ktankink