# Choose Your Format
This guide covers how KC7 works, durations from 45 minutes to a full day, sample agendas, individual vs team play, facilitation, and scoring. Pick the pieces that fit your audience and adapt freely.
***
## 🎮 How KC7 Works
### The Participant Experience
Participants become cyber detectives investigating a security incident. They access the game through your Go Link, read the scenario briefing, analyze security logs in Azure Data Explorer, submit answers to the scoreboard, and pick up cybersecurity concepts along the way.
### The Technology
Azure Data Explorer (ADX) hosts the data, Kusto Query Language (KQL) is how participants query it, the KC7 scoreboard handles the leaderboard and questions, and a built-in training guide walks through the basics.
{% hint style="success" %}
**No installation required.** Everything runs in a browser.
{% endhint %}
***
## 📅 Event Format Options
{% tabs %}
{% tab title="45-Minute Quick Sessions" %}
**Good for:** tight class periods, taster sessions, intros.
**Format:** 5 min welcome, 35 min investigation, 5 min wrap-up.
Most participants will finish 3-6 questions. Frame it as first exposure, not completion, and tell them they can keep going later.
{% endtab %}
{% tab title="90-Minute Sessions" %}
**Good for:** first-time hosts, classroom periods, lunch-and-learns.
**Format:** 10 min welcome and setup, 70 min investigation, 10 min debrief.
Most won't finish all questions. Emphasize discovery over competition.
{% endtab %}
{% tab title="3-Hour Events" %}
**Good for:** after-school programs, professional development, community workshops, team building.
**Format:** 15 min welcome, 10 min teams and setup, 2.5 hours investigation with breaks, 15 min winners and wrap-up.
Many participants will complete the module. Expect natural collaboration.
{% endtab %}
{% tab title="Full-Day Programs" %}
**Good for:** hackathons, training intensives, summer camps, conferences.
**Format:** 30 min welcome and team building, 3-4 hours investigation, 1 hour lunch, 2-3 hours continued play or a new module, 30 min awards and reflection.
Plan for multiple modules and deeper skill development.
{% endtab %}
{% endtabs %}
***
## ⏰ Detailed Event Agendas
### 90-Minute Workshop
| Time | Activity | Host Notes |
| --------- | --------------------------- | ----------------------------------------------------------------------------- |
| 0-5 min | Welcome & introductions | Keep it brief, build energy |
| 5-10 min | KC7 overview & scenario | Use the [host scripts](/hosting-an-event/resources/templates.md#host-scripts) |
| 10-15 min | Account setup & first login | Circulate to help |
| 15-75 min | Investigation time | Roam and encourage, don't solve for them |
| 75-85 min | Share discoveries | Ask "What surprised you?" |
| 85-90 min | Next steps & resources | Leave them wanting more |
### 3-Hour Competition
| Time | Activity | Host Notes |
| ----------- | ----------------------- | -------------------------------------- |
| 0-10 min | Registration & mingling | Background music helps |
| 10-20 min | Welcome & rules | Cover scoring, teams, prizes |
| 20-30 min | Team formation | Mix skill levels, name tags |
| 30-45 min | Setup & first questions | Make sure all teams are progressing |
| 45-135 min | Core investigation | 10-min break around the 90-minute mark |
| 135-145 min | Final submissions | Build excitement |
| 145-165 min | Winner announcements | Celebrate everyone, not just winners |
| 165-180 min | Debrief & networking | Connect to real-world work |
### Half-Day Intensive
| Time | Activity | Host Notes |
| ----------- | -------------------------- | ------------------------------- |
| 0-30 min | Welcome & team building | Icebreakers, collaborative tone |
| 30-60 min | KC7 training & orientation | Deeper cyber concepts |
| 60-180 min | Module 1 | Focus on fundamentals |
| 180-240 min | Lunch & networking | Let teams bond |
| 240-360 min | Module 2 or advanced | For teams who finished |
| 360-390 min | Presentations & awards | Teams share findings |
| 390-420 min | Reflection & next steps | Career pathways |
***
## 👥 Team vs Individual Play
**Individual play** suits classroom assessments, self-paced learning, large events, and mixed skill levels. It keeps logistics simple and tracks individual progress clearly.
**Team play (2-4 people)** suits corporate team building, social events, and skill sharing. You get peer learning and a closer simulation of real-world security work.
{% hint style="warning" %}
**Mixed approaches work.** Even in "individual" events, people will help each other informally.
{% endhint %}
***
## 🎯 Facilitating During the Event
**Opening.** Welcome people warmly, acknowledge all skill levels, frame the experience as discovery, and set expectations ("most people don't finish, and that's fine").
**During investigation.** Circulate continuously instead of camping at the front. Ask open questions like "What are you finding?" rather than "Need help?". Give hints, not answers. Celebrate discoveries out loud, and watch energy levels for when to call a break.
**Wrap up.** Recognize all participants, highlight interesting findings even from incomplete work, connect what they did to real security work, and give clear next steps for continued learning.
***
## 📊 Scoring & Competition Elements
{% tabs %}
{% tab title="Learning-Focused" %}
Hide the scoreboard at first, reveal it near the end, emphasize participation, and award creativity and teamwork. Good for educational settings and beginners.
{% endtab %}
{% tab title="Competitive" %}
Display the live scoreboard, announce leaders periodically, offer real prizes, and consider playoff rounds for top teams. Good for hackathons and corporate events.
{% endtab %}
{% tab title="Collaborative" %}
Share interesting findings publicly, cross-pollinate discoveries between teams, award group achievements, and focus on collective learning. Good for community events and workshops.
{% endtab %}
{% endtabs %}
***
## 🔗 Ready to Plan Your Event?
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.kc7cyber.com/hosting-an-event/planning/event-formats.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.