This is correct.
Just to clarify a bit further:
The gateway sends logs to the log server as soon as it has any meaningful information to share. As more information is available on a connection or attack, the gateway will send additional "update logs" using the same luuid (which is the unique identifier for a log).
This behavior is very common for Accounting information, since more traffic is passed and we want to update the log server on the latest statistics. However, it also happens for other types of information, for example when a security verdict isn't taken in the first millisecond of identifying an attack/connection. An initial log will be sent with available information, and another update log will be sent later with the action.
Our log server has logic to unify these log updates so that customers will "experience" these as a single log with the latest information. When we export data to SIEM, we have less control over the SIEM vendor, so the log updates may appear as duplicates. For some vendors (such as Splunk) we provide our own dashboards that handle these duplications.
If you export using "semi-unified" mode, then each log update will contain all the information accumulated so far. So if you only look at the latest log, you will see the accurate info to that point. It's also possible to export in "raw" mode, which will send the update log data as it's coming in and each log will have just some of the fields.
We are considering a roadmap development in which you can specify that you only want the "last" log when all information has been accumulated. The benefit is having just one log, which is simpler to handle in SIEM. The drawback is that long-lived connections will only be visible when they are closed. I'm curious to hear your feedback if this is a desired solution.
