🎉The Big Day

Here's what you do during a KC7 competition

Congratulations, you’ve put in all the prep work and now it’s time for your big day! Here's how you can introduce the KC7 game and get your learners setup to succeed.

Give a short introduction to the Cyber Competition

• To kick off the session, use the Main Deck found in the KC7 Cyber Competition Kit. The deck contains notes that will guide you through the key talking points for each slide. Here are a few additional tips for the presentation:

  • Bring lots of energy. The KC7 Cyber Game is meant to be fun. Participants will feed off your excitement and passion

  • Keep the presentation section short and sweet. You want to leave plenty of time for participants to engage with the data and learn first-hand, this tends to be their favorite part.

  • Remind participants that this is supposed to be challenging. Avoid saying things like “this is easy” or “anyone can do this.” Instead, remind learners that many of them are building these skills for the first time, and it’s perfectly normal to get stuck or feel frustrated.

Split up the learners into teams:

• We recommend dividing participants into even groups of 4 or 5. If you have a complete list of registrants, you can create the teams in advance.

• If some of your event participants have prior cybersecurity experience, it’s a good idea to nominate those learners as Team Captains. This will help ensure your most experienced participants are divided across teams. It also helps establish leaders within each team who can manage resources and work for the team.

• Participants should sit together with their teammates.

• Help participants get connected to all the required resources:

Take the time to help participants get connected to the KC7 Scoreboard, the Azure Data Explorer (ADX) cluster, and the Training Guide.

1. Each participant will need to create their own account on https://kc7cyber.com/ using the “Create an Account” link. They can subsequently login using the username and password they entered and join the session using the session code provided. We recommend having ALL learners answer the first question to make sure they are connected.

2. Participants will need to login to ADX to access the data needed to answer the questions. They will need to create a Microsoft account to login to ADX. If they have one issued through their school or employer, that will work great! Otherwise, they can login using an existing personal Microsoft account, or create one for free.

3. Participants will need the KC7 Training Guide that corresponds to the Competition module you chose for your event. The Training Guide contains all the background information learners need.

Give learners time to work on Competition questions

• Since participants will be working in teams, they should work collaboratively to learn the query language associated with the given module in the 101 section. Organizers and volunteers should check-in periodically with the participants but try to avoid interrupting too frequently.

• Now, it’s time to get to work! Participants will answer questions as they analyze security log data and identify the threat actors responsible for targeting their fictional company.

Here are some tips for guiding participants through the questions:

• Don’t give them the answers to the questions. It may be tempting to show them exactly how to answer a question, or to give them the answer directly, but this doesn’t help them learn. Instead, ask them to explain their thought process and current approach to you, then ask them probing questions that can help them reconsider how to best solve the question they’re stuck on.

• Encourage them to seek help from their teammates. Participants often really enjoy helping their peers understand the challenging concepts.. When participants ask organizers or volunteers for help, make sure they’ve discussed the problem with their team before coming to you.

• Be positive and encouraging. It can be frustrating for participants to get stuck on a particular question. Remind them that this is meant to be challenging. It’s good to mention that real cyber threat analysts get stuck too. When they overcome a question they’re stuck on, congratulate them!

Here are some common issues learners may have and some tips for getting past them:

Issue	Solution
Participants can’t find details from the Competition question in the data	Participants may have accidentally selected the wrong database in ADX. Check their cluster list and make sure the proper cluster is selected (highlighted in blue).
Participants get a query error	Common mistakes: Each line of the query must start with a pipe character KQL operators and column names are case sensitive When using let statements, the query must end with an output Separate queries against different table must be separated by one or more blank lines They may be querying the wrong database
Unable to login to Scoreboard after creating new account	Participants must use their username (not their email) to login to the Scoreboard

Monitor the KC7 Scoreboard to measure progress.

We recommend monitoring the KC7 Scoreboard throughout the course of the Competition. If you notice scores stalling, it might be a good idea to check in with the teams to see where participants are getting stuck. You can also monitor for participants who are logging behind the average player. Make sure to check in with those teams to see if you can help get them unblocked.

Announce to all participants that 30 minutes remain in the Competition.

Encourage them to find questions within the module that they can answer to earn as many points as possible, rather than answering the questions in order.