# Choose Your Format

*←* [*Back to Planning Your Event*](https://docs.kc7cyber.com/hosting-an-event/planning) *|* [*Getting Started*](https://docs.kc7cyber.com/hosting-an-event/getting-started) *|* [*Home*](https://docs.kc7cyber.com/readme)

***

## Event Formats & Timing

{% hint style="info" %}
**KC7 is flexible!** Adapt these templates to match your audience, venue, and goals. There's no single "right" way to run an event.
{% endhint %}

### Overview

This guide helps you choose and execute the right format for your KC7 event. It covers how KC7 works technically, event duration options (45 minutes to full-day), detailed timing agendas, individual vs. team structures, facilitation techniques, and scoring approaches. Use this to design your event flow from welcome to wrap-up.

***

### 🎮 How KC7 Works

#### The Participant Experience

Participants become cyber detectives investigating a security incident:

1. **Access** the game through your Go Link
2. **Read** the scenario briefing and training guide
3. **Analyze** security log data using Azure Data Explorer (ADX)
4. **Answer** questions by submitting findings to the scoreboard
5. **Learn** cybersecurity concepts through hands-on investigation

#### The Technology

* **Azure Data Explorer (ADX)** - Cloud-based data analysis platform
* **Kusto Query Language (KQL)** - Simple query language for investigating logs
* **KC7 Scoreboard** - Real-time leaderboard and question interface
* **Training Guide** - Built-in tutorials and examples

{% hint style="success" %}
**No installation required!** Everything runs in a web browser.
{% endhint %}

***

### 📅 Event Format Options

Choose the format that works best for your goals:

{% tabs %}
{% tab title="45-Minute Quick Sessions" %}
**Perfect for:**

* Tight class periods
* Taster sessions
* Introduction to cybersecurity
* Time-constrained schedules

**Format:**

* 5 min: Quick welcome & link sharing
* 35 min: Investigation time
* 5 min: Brief wrap-up

**Participant expectations:**

* Most will complete 3-6 questions
* Focus on first exposure, not completion
* Emphasize that they can continue later
* Build curiosity for future sessions
  {% endtab %}

{% tab title="90-Minute Sessions" %}
**Perfect for:**

* First-time hosts
* Classroom periods
* Lunch-and-learns
* Intro workshops

**Format:**

* 10 min: Welcome & setup
* 70 min: Investigation time
* 10 min: Quick debrief

**Participant expectations:**

* Focus on learning, not completion
* Most won't finish all questions
* Emphasize discovery over competition
  {% endtab %}

{% tab title="3-Hour Events" %}
**Perfect for:**

* After-school programs
* Professional development
* Community workshops
* Team building

**Format:**

* 15 min: Welcome & introductions
* 10 min: Teams & setup
* 2.5 hrs: Investigation (with breaks)
* 15 min: Winners & wrap-up

**Participant expectations:**

* Many will complete the module
* Balanced learning and competition
* Natural collaboration
  {% endtab %}

{% tab title="Full-Day Programs" %}
**Perfect for:**

* Hackathons
* Training intensives
* Summer camps
* Conference sessions

**Format:**

* 30 min: Welcome & team building
* 3-4 hrs: Investigation
* 1 hr: Lunch break
* 2-3 hrs: Continued investigation or new module
* 30 min: Awards & reflection

**Participant expectations:**

* Complete multiple modules
* Deep skill development
* Strong team dynamics
  {% endtab %}
  {% endtabs %}

***

### ⏰ Detailed Event Agendas

#### 90-Minute Workshop Template

| Time          | Activity                      | Host Notes                                                                         |
| ------------- | ----------------------------- | ---------------------------------------------------------------------------------- |
| **0-5 min**   | Welcome & introductions       | Keep it brief, build energy                                                        |
| **5-10 min**  | KC7 overview & scenario setup | Use our [host scripts](https://docs.kc7cyber.com/resources/templates#host-scripts) |
| **10-15 min** | Account setup & first login   | Circulate to help with tech issues                                                 |
| **15-75 min** | Investigation time            | **Roam and encourage**, don't solve for them                                       |
| **75-85 min** | Share discoveries             | Ask "What surprised you?" not "Did you finish?"                                    |
| **85-90 min** | Next steps & resources        | Leave them wanting more                                                            |

#### 3-Hour Competition Template

| Time            | Activity                | Host Notes                            |
| --------------- | ----------------------- | ------------------------------------- |
| **0-10 min**    | Registration & mingling | Play energetic background music       |
| **10-20 min**   | Welcome & rules         | Explain scoring, teams, prizes        |
| **20-30 min**   | Team formation          | Mix skill levels, provide name tags   |
| **30-45 min**   | Setup & first questions | Ensure all teams are progressing      |
| **45-135 min**  | Core investigation time | Plan a 10-min break around 90 minutes |
| **135-145 min** | Final submissions       | Build excitement for results          |
| **145-165 min** | Winner announcements    | Celebrate everyone, not just winners  |
| **165-180 min** | Debrief & networking    | Connect learning to real world        |

#### Half-Day Intensive Template

| Time            | Activity                          | Host Notes                              |
| --------------- | --------------------------------- | --------------------------------------- |
| **0-30 min**    | Welcome & team building           | Icebreakers, set collaborative tone     |
| **30-60 min**   | KC7 training & orientation        | Deeper dive into cybersecurity concepts |
| **60-180 min**  | Module 1: "A Scandal in Valdoria" | Focus on learning fundamentals          |
| **180-240 min** | Lunch & networking                | Let teams bond                          |
| **240-360 min** | Module 2 or advanced challenges   | For teams who completed Module 1        |
| **360-390 min** | Presentations & awards            | Teams present their findings            |
| **390-420 min** | Reflection & next steps           | Career pathways, continued learning     |

***

### 👥 Team vs Individual Play

#### Individual Play

**Best for:**

* Classroom assessments
* Self-paced learning
* Large events (easier logistics)
* Mixed skill levels

**Benefits:**

* Personal achievement focus
* No team coordination needed
* Clear individual progress tracking

#### Team Play (2-4 people)

**Best for:**

* Corporate team building
* Collaborative learning goals
* Social events
* Skill sharing

**Benefits:**

* Peer learning
* Social engagement
* Knowledge sharing
* Real-world simulation

{% hint style="warning" %}
**Mixed approaches work too!** Individuals can informally help each other even in "individual" events.
{% endhint %}

***

### 🎯 Facilitating During the Event

#### Opening Energy

* **Welcome everyone warmly** - Set a positive, inclusive tone
* **Acknowledge all skill levels** - "Beginners and experts both learn here"
* **Emphasize discovery** - "You're going to uncover some interesting things"
* **Set realistic expectations** - "Most people don't finish, and that's perfectly fine"

#### During Investigation

* **Circulate continuously** - Don't camp at the front
* **Ask open questions** - "What are you finding?" rather than "Need help?"
* **Give hints, not answers** - Guide their thinking
* **Celebrate discoveries** - "Oh, that's a great observation!"
* **Monitor energy levels** - Call breaks when needed

#### Wrapping Up

* **Celebrate all participants** - Not just high scorers
* **Highlight interesting discoveries** - Even from incomplete work
* **Connect to real world** - "This is what security analysts do daily"
* **Provide next steps** - How to continue learning

***

### 📊 Scoring & Competition Elements

#### Scoring Options

{% tabs %}
{% tab title="Learning-Focused" %}

* **Hide the scoreboard** initially
* **Reveal near the end** for fun
* **Emphasize participation** over points
* **Award creativity** and teamwork

**Good for:** Educational settings, beginners
{% endtab %}

{% tab title="Competitive" %}

* **Display live scoreboard** prominently
* **Announce leaders** periodically
* **Offer substantial prizes** for winners
* **Create playoff rounds** for top teams

**Good for:** Hackathons, corporate events
{% endtab %}

{% tab title="Collaborative" %}

* **Share interesting findings** publicly
* **Cross-pollinate discoveries** between teams
* **Award group achievements**
* **Focus on collective learning**

**Good for:** Community events, workshops
{% endtab %}
{% endtabs %}

***

### 🔗 Ready to Plan Your Event?

Use these resources to design your specific event:

<table data-view="cards"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>Host Scripts</strong></td><td><a href="../../resources/templates#host-scripts">What to say →</a></td></tr><tr><td><strong>Day-of Guide</strong></td><td><a href="../running/event-day">Running events →</a></td></tr><tr><td><strong>Troubleshooting</strong></td><td><a href="../resources/troubleshooting">Common issues →</a></td></tr><tr><td><strong>Host Preparation</strong></td><td><a href="../running/pre-event-setup">Get ready →</a></td></tr></tbody></table>

***

{% hint style="success" %}
**Remember:** The best event format is the one that matches your goals and constraints. Start simple and evolve based on experience!
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.kc7cyber.com/hosting-an-event/planning/event-formats.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.