
The Case Vault
These organizations were breached. Your mission: review the digital evidence, reconstruct the events, and uncover who was behind it—and how they got in.
Easy
This is the start of your KC7 journey. You don’t need to know much— we give you the questions and starter KQL so you can focus on the story and how evidence fits together. You’ll leave with quick wins and the core “investigator mindset.”
Moderate
In this section, the training wheels start to come off. You’ll translate questions into your own KQL and spot repeating patterns. Expect growing confidence and fewer “wait…what is that?” moments.
Challenging
Now you choose where to look and why. You’ll connect clues across multiple logs, write multi-step queries, and explain your reasoning like a pro. Mistakes are part of the reps—your intuition gets sharper every case.
Hard
In these games, guidance is minimal and the intrusion is messy (just like real life). You’ll sketch a plan, pivot across data sources, validate each finding, and adjust on the fly. Expect fewer hints, more strategy, and satisfyingly hard-won answers.
Don't Bother
Fleeeee!!! I mean, err... You’re driving the whole investigation—scope it, hunt it, prove it, tell the story. We give you the case; you deliver conclusions backed by evidence and a clean narrative. Expect portfolio-ready work and the “I can handle new stuff” confidence that senior analysts rely on.

.png)
 - Recording mic.png)





























