Techniques are described herein that are capable of updating a state of a client device using a limited event size protocol. An initial state of the client device is stored. The initial state is defined by first records that identify first respective binaries associated with the client device at a first time. A first event of multiple events, which are configured in accordance with the limited event size protocol, is received from the client device. Each event includes a respective subset of second records, which identify respective second binaries associated with the client device at a second time. The first event is parsed to identify a first subset of the second records that is included in the first event. An updated state of the client device is generated by replacing a first portion of the first records with the first subset of the second records.