Slips sends every new evidence using publish_single_evidence() as soon as they're set.
Then, when an alert is generated, in evidencehandler.py > handle_new_alert() > send_to_exporting_module() sends all evidence of the alert again to the exporting modules.