Abstract: Techniques are described herein that are capable of updating a state of a client device using a limited event size protocol. An initial state of the client device is stored. The initial state is defined by first records that identify first respective binaries associated with the client device at a first time. A first event of multiple events, which are configured in accordance with the limited event size protocol, is received from the client device. Each event includes a respective subset of second records, which identify respective second binaries associated with the client device at a second time. The first event is parsed to identify a first subset of the second records that is included in the first event. An updated state of the client device is generated by replacing a first portion of the first records with the first subset of the second records.

Abstract: Techniques are described herein that are capable of updating a state of a client device using a limited event size protocol. An initial state of the client device is stored. The initial state is defined by first records that identify first respective binaries associated with the client device at a first time. A first event of multiple events, which are configured in accordance with the limited event size protocol, is received from the client device. Each event includes a respective subset of second records, which identify respective second binaries associated with the client device at a second time. The first event is parsed to identify a first subset of the second records that is included in the first event. An updated state of the client device is generated by replacing a first portion of the first records with the first subset of the second records.

Abstract: Technology described herein determines whether a device is Internet facing. An Internet facing device is a device where traffic coming from the Internet is routable to the device. The technology described herein may comprise two components that work together to identify Internet-facing devices. The first component is a monitoring agent installed on organizational devices. The second component is an Internet-facing management service, which may be cloud based. The monitoring agent communicates connection-event notices to the Internet-facing management service. The source IP address in the connection-event notice is compared to a list of organizational IP addresses. If the source IP address is not on the list, then the computing device associated with the notice is added to a list of Internet-facing devices because the connection originated from the Internet. Software listed in the connection-event notice may be added to a list of internet-facing software instances.