notifications recognition dates + geenforce B2 client

plugins/geenforce/importer.py

@@ -48,6 +48,11 @@ def populate_entry(entry, entry_dict):
     # RegValue stored as its raw JSON literal so DWord vs string typing survives.
     entry.regvalue = (json.dumps(entry_dict['RegValue'])
                       if 'RegValue' in entry_dict else None)
+    # Payload transport (http/inline share-less delivery); default smb. Kept out
+    # of the scalar map so smb entries stay bare (conditional emit + parity).
+    entry.payloadsource = entry_dict.get('PayloadSource') or 'smb'
+    entry.payloadsha256 = entry_dict.get('PayloadSha256')
+    entry.payloadref = entry_dict.get('PayloadRef')
     for key, attr in _FLAG_TO_ATTR.items():
         setattr(entry, attr, bool(entry_dict.get(key)))
     # Multi-value filters -> child rows (replace, preserve order).