Pick a format
Pick a duration, agenda, and play style for your KC7 event
This page helps you pick a duration, agenda, and play style. Durations run from 45 minutes to a full day.
How KC7 works
Participants become cyber detectives investigating a security incident. They open the participant link, read a scenario briefing, query security logs in Azure Data Explorer, and submit answers to the scoreboard. Cybersecurity concepts come along with the work.
The stack is browser-only. Azure Data Explorer (ADX) hosts the data, Kusto Query Language (KQL) is how participants query it, the KC7 scoreboard tracks questions and progress, and a built-in training guide covers the basics.
Pick a duration
Good for tight class periods, taster sessions, intros.
Format: 5 min welcome, 35 min investigation, 5 min wrap-up.
Most participants finish 3-6 questions. Frame it as first exposure, not completion. Tell them they can keep going later.
Good for first-time hosts, classroom periods, lunch-and-learns.
Format: 10 min welcome and setup, 70 min investigation, 10 min debrief.
Most won't finish all questions. Emphasize discovery over competition.
Good for after-school programs, professional development, community workshops, team building.
Format: 15 min welcome, 10 min teams and setup, 2.5 hours investigation with breaks, 15 min winners and wrap-up.
Many participants complete the module. Expect natural collaboration.
Good for hackathons, training intensives, summer camps, conferences.
Format: 30 min welcome and team building, 3-4 hours investigation, 1 hour lunch, 2-3 hours continued play or a new module, 30 min awards and reflection.
Plan for multiple modules and deeper skill development.
No installation required. Everything runs in a browser.
Sample agendas
90-minute workshop
0-5 min
Welcome and introductions
Keep it brief, build energy
10-15 min
Account setup and first login
Circulate to help
15-75 min
Investigation time
Roam and encourage, don't solve
75-85 min
Share discoveries
Ask "What surprised you?"
85-90 min
Next steps and resources
Leave them wanting more
3-hour competition
0-10 min
Registration and mingling
Background music helps
10-20 min
Welcome and rules
Cover scoring, teams, prizes
20-30 min
Team formation
Mix skill levels, name tags
30-45 min
Setup and first questions
Make sure all teams are progressing
45-135 min
Core investigation
10-min break around the 90-minute mark
135-145 min
Final submissions
Build excitement
145-165 min
Winner announcements
Celebrate everyone, not just winners
165-180 min
Debrief and networking
Connect to real-world work
Half-day intensive
0-30 min
Welcome and team building
Icebreakers, collaborative tone
30-60 min
KC7 training and orientation
Deeper cyber concepts
60-180 min
Module 1
Focus on fundamentals
180-240 min
Lunch and networking
Let teams bond
240-360 min
Module 2 or advanced
For teams who finished
360-390 min
Presentations and awards
Teams share findings
390-420 min
Reflection and next steps
Career pathways
Choose individual or team play
Individual play suits classroom assessments, self-paced learning, large events, and mixed skill levels. Logistics stay simple and progress tracks per person.
Team play (2-4 people) suits corporate team building, social events, and skill sharing. You get peer learning and a closer simulation of real security work.
Even in individual events, people help each other informally. That's fine.
Facilitate during the event
Opening. Welcome people warmly, acknowledge all skill levels, frame the experience as discovery. Set expectations: most people don't finish, and that's fine.
Investigation. Circulate continuously instead of camping at the front. Ask open questions like "What are you finding?" rather than "Need help?". Give hints, not answers. Call out discoveries out loud. Watch energy levels for when to call a break.
Wrap-up. Recognize all participants, highlight interesting findings even from incomplete work, connect what they did to real security work, and give clear next steps.
Pick a scoring posture
Hide the scoreboard at first, reveal it near the end, emphasize participation, and award creativity and teamwork. Good for educational settings and beginners.
Display the live scoreboard, announce leaders periodically, offer real prizes, and consider playoff rounds for top teams. Good for hackathons and corporate events.
Share interesting findings publicly, cross-pollinate discoveries between teams, award group achievements, and focus on collective learning. Good for community events and workshops.
Next steps
Last updated