This article is based on event information originally published on devops.com in May 2020.
What Is VMware Carbon Black Developer Day?
VMware Carbon Black Developer Day is an annual virtual event designed to connect intermediate and advanced security developers directly with Carbon Black platform experts. The focus is hands-on and practical: attendees learn advanced API usage, integration patterns, and workflow automation techniques for the Carbon Black security platform.
The 2020 edition took place on Tuesday, May 12, starting at 11 a.m. EST — the day before VMware Carbon Black’s Connect 2020 virtual conference. The event ran for approximately four hours.
Why Developer Day Matters for DevSecOps
A recurring challenge in DevSecOps is integrating security tooling into existing developer and operations workflows without creating friction. Developer Day addresses this directly by teaching engineers how to automate security operations through the Carbon Black API and by showcasing partner integrations that demonstrate real-world implementation patterns.
Sessions are delivered by the VMware Carbon Black developer relations team and by technology partners who have already built production integrations against Carbon Black APIs — giving attendees access to tested, practical knowledge rather than purely theoretical guidance.
Session Highlights: What Was Covered
The 2020 Developer Day agenda covered a range of topics spanning the Carbon Black Cloud platform and its ecosystem:
- Open-source security operations toolkit: How to build an open-source toolkit that leverages Carbon Black’s complete platform API to enable security operations at scale.
- Red Canary integration: Using Red Canary’s suite of tools in combination with Carbon Black to support a variety of security operations use cases.
- Latest platform capability demos: Live demonstrations of recently shipped features across the Carbon Black Cloud platform.
- Carbon Black Cloud Event Forwarder: A getting-started guide for the Event Forwarder, which allows teams to stream endpoint telemetry data to external SIEMs and data pipelines.
- Binary Analysis SDK: An introduction to the Binary Analysis SDK — described as the newest addition to the Carbon Black Cloud developer toolbox at the time — enabling programmatic file and binary analysis.
- VMware Carbon Black EDR + Lastline Defender integration: A demo of a bidirectional integration between Carbon Black EDR (Endpoint Detection and Response) and Lastline Defender, illustrating how two security products can share context in real time.
- Carbon Black Developer Network roadmap: A preview of what was coming next for the Carbon Black developer ecosystem and community.
Key Themes: APIs, Automation, and Integration
Several themes run through the Developer Day agenda that reflect broader trends in DevSecOps practice:
API-First Security
Carbon Black Cloud exposes a comprehensive REST API that allows security teams to query endpoint data, manage policies, and trigger response actions programmatically. Developer Day sessions taught engineers how to leverage these APIs to build custom tooling rather than relying solely on the console UI — a critical capability for teams operating at scale.
Bidirectional Integrations
The VMware Carbon Black EDR and Lastline Defender integration demo highlighted the value of bidirectional data sharing between security products. When an endpoint detection platform and a network threat analysis tool share enriched context in both directions, security analysts benefit from a more complete picture without manually correlating data across separate consoles.
Event Streaming and SIEM Integration
The Carbon Black Cloud Event Forwarder session addressed a common operational requirement: getting endpoint telemetry into centralized logging and SIEM platforms. This kind of event forwarding capability is essential for teams that use tools such as Splunk, Elastic, or cloud-native logging services alongside their endpoint security platform.
Leadership Perspective
Scott Lundgren, CTO of VMware Carbon Black, spoke with MediaOps Managing Editor Charlene O’Hanlon ahead of the event to discuss what attendees could expect from the four-hour program. Lundgren’s involvement underscored the strategic importance VMware Carbon Black placed on its developer community and API ecosystem.
Takeaways for Security Engineers and DevSecOps Teams
Even viewed retrospectively, the Developer Day 2020 agenda offers a useful snapshot of the capabilities and integration patterns that security engineering teams were building around endpoint security platforms in 2020. The focus on open-source tooling, SDKs, event streaming, and bidirectional partner integrations remains highly relevant for teams designing security automation pipelines today.
- Invest in API-driven workflows to reduce manual security operations toil.
- Use event forwarding to centralize telemetry and feed existing SIEM or data lake investments.
- Explore partner integrations before building custom connectors — production-tested integrations save significant engineering time.
- Contribute to and consume open-source security toolkits to accelerate internal tooling development.
For current documentation on the Carbon Black Cloud API and developer resources, refer to the VMware Carbon Black Developer Network.