> For the complete documentation index, see [llms.txt](https://docs.kc7cyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kc7cyber.com/getting-started/what-is-kc7.md). # What is a KC7 event? A KC7 event is a hands-on cybersecurity experience where participants become investigators, working through a realistic (but fictional) cyber mystery using the same tools that professional analysts rely on every day. You bring the people and the setting. KC7 provides the game, the training, and the content, so you don't need a cybersecurity background to host. ## A cybersecurity mystery game built for beginners KC7 is a story-driven cybersecurity game where players step into the role of investigators solving a cyber incident. They analyze simulated computer and network activity, look for suspicious patterns, and answer questions that move the story forward. The experience is designed from the ground up for people with no prior cybersecurity knowledge. Early questions teach the fundamentals, and each new challenge builds naturally on what came before. By the end, participants have practiced real skills like building a timeline of events, thinking logically about evidence, and explaining what happened in plain language. {% embed url="" %} ## Your role as host: set the stage, not the curriculum Hosting a KC7 event means gathering a group, whether students, employees, or community members, and giving them a shared space to learn together. You provide the time, the venue (physical or virtual), and the encouragement. KC7 handles everything instructional, including the game, the training content, and the built-in support that keeps participants moving forward. Your event might be a 90-minute classroom activity, a 3-hour team-building session, or a full-day workshop, in a computer lab, a conference room, or over Zoom. During the event, you circulate the room, answer logistical questions, keep energy up, and celebrate discoveries as they happen. ## Educators, trainers, and community leaders run these events **Educators** use KC7 to introduce students to cybersecurity careers and computational thinking without having to teach the technical material themselves. The platform handles the instruction, freeing you to focus on facilitation and encouragement. **HR and corporate trainers** use it for security awareness training that doubles as team building. Employees learn to think like both attackers and defenders, and the interactive format sticks far better than slide decks. **Community organizers and student leaders** use it to bring people together around technology in an accessible, low-barrier way. No expensive equipment and no specialized instructors, just computers and an internet connection. **People building a cybersecurity program** use KC7 as a low-friction starting point. Run one successful event, gauge interest, and expand from there. ## How the game works for participants Every participant follows the same path through the experience: 1. Open the participant link in their browser 2. Read the scenario briefing that sets up the mystery 3. Investigate using real security analysis tools embedded in the platform 4. Analyze log data to piece together what happened 5. Submit findings to the scoreboard as they progress 6. Pick up cybersecurity concepts naturally through the work itself There's nothing to install, no accounts to create ahead of time, and no prerequisites to worry about. ## The tools are real Under the hood, participants work with the same technology stack that professional security analysts use daily: * **Azure Data Explorer (ADX)** stores and serves the security logs participants investigate * **Kusto Query Language (KQL)** is how they filter, search, and analyze the data * **KC7 Scoreboard** tracks progress and validates their answers in real time * **Built-in tutorials** are woven directly into the scenario, teaching concepts exactly when they're needed ## You don't need a cybersecurity background **The game teaches participants directly.** KC7 scenarios assume zero prior knowledge. Early questions introduce the basics, later challenges build on those foundations, and your role is keeping people motivated rather than explaining technical concepts. **The story carries the engagement.** Participants stay invested because they genuinely want to find out what happens next. **Hints are built into the platform.** When someone gets stuck, the game offers progressive hints that guide them forward without giving away the answer. You don't need to debug their queries or explain log formats. The platform handles that. KC7 runs from a 45-minute taster to a full-day workshop, played competitively, collaboratively, or learning-focused. See [Pick a format](/planning/event-formats.md) to choose one. ## Skills participants walk away with Participants practice the same skills professional security analysts use day to day: * **Log analysis** — reading and interpreting security event data * **Query writing** — using KQL to search and filter large datasets * **Pattern recognition** — spotting anomalies that point to suspicious activity * **Threat hunting** — following evidence trails to uncover what happened * **Critical thinking** — making judgments under uncertainty with incomplete information The thinking transfers beyond cybersecurity too: analyzing complex information, reasoning from evidence, and explaining technical findings in plain language. ## Your first scenario: A Scandal in Valdoria Every host's first event runs KC7's flagship scenario — a mysterious security incident in the Kingdom of Valdoria, layered with political intrigue and digital evidence. The questions ramp up gradually: early ones teach basic log analysis and querying, middle ones apply those skills to deeper investigations, and later ones ask participants to synthesize evidence and draw conclusions. Most participants won't finish the entire scenario in a single session, and that's perfectly fine. Whether someone completes five questions or fifteen, they've had a meaningful learning experience. Everyone walks away having practiced real investigation skills, regardless of where they stop. ## What you'll need to get started **For you:** * A free KC7 account, which gets created automatically when you request your event * About 1 to 2 days for your event request to be approved * A venue — either a physical space or a virtual meeting platform **For your participants:** * A computer with a modern browser (Chrome, Firefox, Edge, or Safari) * An internet connection * A willingness to try something new If someone can browse the web, they can play KC7. ## Start with one event and grow from there Most hosts run their first event as a trial. Run a single event and stop, or build KC7 into an ongoing program. Your account supports both, and the [tenant guide](/your-tenant/overview.md) covers the platform once you want more. ## Ready to host?
Run your first eventThe fast path, in about 5 minutes of reading./pages/Nqy40PvdTEQISumx9CYV
Request your eventSubmit the request form to get started./pages/eJw2rox7Ci2KOWlenwLY
Plan your eventWalk through the full planning process./pages/BEfCPNIZZyPgo4r5OpkS
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.kc7cyber.com/getting-started/what-is-kc7.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.