We are using analyzing Checkpoint Events on SIEM. When one of our clients goes and watches some videos on Youtube Checkpoint LOGS&MONITOR shows 1 session in application control blade. Then when client closes youtube on browser, on checkpoint side session still continues. Problem is while session is continues on SIEM side there will be more then 1 log about that session and accounting bytes on checkpoint summing the total count but it sending each log with different bytes info. Attachments explains clear.