> For the complete documentation index, see [llms.txt](https://docs.kc7cyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kc7cyber.com/planning/event-formats.md).
# Pick a format
This page helps you pick a duration, agenda, and play style. Durations run from 45 minutes to a full day.
## How KC7 works
Participants become cyber detectives investigating a security incident. They open the participant link, read a scenario briefing, query security logs in Azure Data Explorer, and submit answers to the scoreboard. Cybersecurity concepts come along with the work.
The stack is browser-only. Azure Data Explorer (ADX) hosts the data, Kusto Query Language (KQL) is how participants query it, the KC7 scoreboard tracks questions and progress, and a built-in training guide covers the basics.
## Pick a duration
{% tabs %}
{% tab title="45 minutes" %}
**Good for** tight class periods, taster sessions, intros.
**Format:** 5 min welcome, 35 min investigation, 5 min wrap-up.
Most participants finish 3-6 questions. Frame it as first exposure, not completion. Tell them they can keep going later.
{% endtab %}
{% tab title="90 minutes" %}
**Good for** first-time hosts, classroom periods, lunch-and-learns.
**Format:** 10 min welcome and setup, 70 min investigation, 10 min debrief.
Most won't finish all questions. Emphasize discovery over competition.
{% endtab %}
{% tab title="3 hours" %}
**Good for** after-school programs, professional development, community workshops, team building.
**Format:** 15 min welcome, 10 min teams and setup, 2.5 hours investigation with breaks, 15 min winners and wrap-up.
Many participants complete the module. Expect natural collaboration.
{% endtab %}
{% tab title="Full day" %}
**Good for** hackathons, training intensives, summer camps, conferences.
**Format:** 30 min welcome and team building, 3-4 hours investigation, 1 hour lunch, 2-3 hours continued play or a new module, 30 min awards and reflection.
Plan for multiple modules and deeper skill development.
{% endtab %}
{% endtabs %}
{% hint style="info" %}
No installation required. Everything runs in a browser.
{% endhint %}
## Sample agendas
### 90-minute workshop
| Time | Activity | Host notes |
| --------- | ----------------------------- | ----------------------------------------------------- |
| 0-5 min | Welcome and introductions | Keep it brief, build energy |
| 5-10 min | KC7 overview and scenario | Use the [host scripts](/event-resources/templates.md) |
| 10-15 min | Account setup and first login | Circulate to help |
| 15-75 min | Investigation time | Roam and encourage, don't solve |
| 75-85 min | Share discoveries | Ask "What surprised you?" |
| 85-90 min | Next steps and resources | Leave them wanting more |
### 3-hour competition
| Time | Activity | Host notes |
| ----------- | ------------------------- | -------------------------------------- |
| 0-10 min | Registration and mingling | Background music helps |
| 10-20 min | Welcome and rules | Cover scoring, teams, prizes |
| 20-30 min | Team formation | Mix skill levels, name tags |
| 30-45 min | Setup and first questions | Make sure all teams are progressing |
| 45-135 min | Core investigation | 10-min break around the 90-minute mark |
| 135-145 min | Final submissions | Build excitement |
| 145-165 min | Winner announcements | Celebrate everyone, not just winners |
| 165-180 min | Debrief and networking | Connect to real-world work |
### Half-day intensive
| Time | Activity | Host notes |
| ----------- | ---------------------------- | ------------------------------- |
| 0-30 min | Welcome and team building | Icebreakers, collaborative tone |
| 30-60 min | KC7 training and orientation | Deeper cyber concepts |
| 60-180 min | Module 1 | Focus on fundamentals |
| 180-240 min | Lunch and networking | Let teams bond |
| 240-360 min | Module 2 or advanced | For teams who finished |
| 360-390 min | Presentations and awards | Teams share findings |
| 390-420 min | Reflection and next steps | Career pathways |
## Choose individual or team play
**Individual play** suits classroom assessments, self-paced learning, large events, and mixed skill levels. Logistics stay simple and progress tracks per person.
**Team play (2-4 people)** suits corporate team building, social events, and skill sharing. You get peer learning and a closer simulation of real security work.
Even in individual events, people help each other informally. That's fine.
## Facilitate during the event
**Opening.** Welcome people warmly, acknowledge all skill levels, frame the experience as discovery. Set expectations: most people don't finish, and that's fine.
**Investigation.** Circulate continuously instead of camping at the front. Ask open questions like "What are you finding?" rather than "Need help?". Give hints, not answers. Call out discoveries out loud. Watch energy levels for when to call a break.
**Wrap-up.** Recognize all participants, highlight interesting findings even from incomplete work, connect what they did to real security work, and give clear next steps.
## Pick a scoring posture
{% tabs %}
{% tab title="Learning-focused" %}
Hide the scoreboard at first, reveal it near the end, emphasize participation, and award creativity and teamwork. Good for educational settings and beginners.
{% endtab %}
{% tab title="Competitive" %}
Display the live scoreboard, announce leaders periodically, offer real prizes, and consider playoff rounds for top teams. Good for hackathons and corporate events.
{% endtab %}
{% tab title="Collaborative" %}
Share interesting findings publicly, cross-pollinate discoveries between teams, award group achievements, and focus on collective learning. Good for community events and workshops.
{% endtab %}
{% endtabs %}
## Next steps
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.kc7cyber.com/planning/event-formats.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.