Event Layout & Flow

Flexible event formats and timing guides for successful KC7 competitions

KC7 is flexible! Adapt these templates to match your audience, venue, and goals. There's no single "right" way to run an event.

🎮 How KC7 Works

The Participant Experience

Participants become cyber detectives investigating a security incident:

Access the game through your Go Link
Read the scenario briefing and training guide
Analyze security log data using Azure Data Explorer (ADX)
Answer questions by submitting findings to the scoreboard
Learn cybersecurity concepts through hands-on investigation

The Technology

Azure Data Explorer (ADX) - Cloud-based data analysis platform
Kusto Query Language (KQL) - Simple query language for investigating logs
KC7 Scoreboard - Real-time leaderboard and question interface
Training Guide - Built-in tutorials and examples

No installation required! Everything runs in a web browser.

📅 Event Format Options

Choose the format that works best for your goals:

Perfect for:

First-time hosts
Classroom periods
Lunch-and-learns
Intro workshops

Format:

10 min: Welcome & setup
70 min: Investigation time
10 min: Quick debrief

Participant expectations:

Focus on learning, not completion
Most won't finish all questions
Emphasize discovery over competition

⏰ Detailed Event Agendas

90-Minute Workshop Template

Time

Activity

Host Notes

0-5 min

Welcome & introductions

Keep it brief, build energy

5-10 min

KC7 overview & scenario setup

Use our host scripts

10-15 min

Account setup & first login

Circulate to help with tech issues

15-75 min

Investigation time

Roam and encourage, don't solve for them

75-85 min

Share discoveries

Ask "What surprised you?" not "Did you finish?"

85-90 min

Next steps & resources

Leave them wanting more

3-Hour Competition Template

Time

Activity

Host Notes

0-10 min

Registration & mingling

Play energetic background music

10-20 min

Welcome & rules

Explain scoring, teams, prizes

20-30 min

Team formation

Mix skill levels, provide name tags

30-45 min

Setup & first questions

Ensure all teams are progressing

45-135 min

Core investigation time

Plan a 10-min break around 90 minutes

135-145 min

Final submissions

Build excitement for results

145-165 min

Winner announcements

Celebrate everyone, not just winners

165-180 min

Debrief & networking

Connect learning to real world

Half-Day Intensive Template

Time

Activity

Host Notes

0-30 min

Welcome & team building

Icebreakers, set collaborative tone

30-60 min

KC7 training & orientation

Deeper dive into cybersecurity concepts

60-180 min

Module 1: "A Scandal in Valdoria"

Focus on learning fundamentals

180-240 min

Lunch & networking

Let teams bond

240-360 min

Module 2 or advanced challenges

For teams who completed Module 1

360-390 min

Presentations & awards

Teams present their findings

390-420 min

Reflection & next steps

Career pathways, continued learning

👥 Team vs Individual Play

Individual Play

Best for:

Classroom assessments
Self-paced learning
Large events (easier logistics)
Mixed skill levels

Benefits:

Personal achievement focus
No team coordination needed
Clear individual progress tracking

Team Play (2-4 people)

Best for:

Corporate team building
Collaborative learning goals
Social events
Skill sharing

Benefits:

Peer learning
Social engagement
Knowledge sharing
Real-world simulation

Mixed approaches work too! Individuals can informally help each other even in "individual" events.

🎯 Facilitating During the Event

Opening Energy

Welcome everyone warmly - Set a positive, inclusive tone
Acknowledge all skill levels - "Beginners and experts both learn here"
Emphasize discovery - "You're going to uncover some interesting things"
Set realistic expectations - "Most people don't finish, and that's perfectly fine"