When Arc Goes Silent: Turning Visibility Gaps into SOC Action

Hybrid blind spots rarely announce themselves. They appear when an Azure Arc-enabled server drops out, health signals go stale, and the SOC loses confidence in monitoring coverage. This playbook uses Microsoft Sentinel and Logic Apps to turn that noise into one clear daily signal the team can act on. 

The problem: too much noise, not enough assurance 

One unhealthy server, one alert, one more email—at scale, that does not help the SOC. What leaders need is assurance: where visibility is weakening, which systems matter, and when action is needed. 

The use case: daily assurance for hybrid monitoring coverage 

The use case is simple: identify Arc-enabled servers that stay unhealthy beyond a set threshold, such as 30 minutes, and send one consolidated summary each day. For a CISO, this improves assurance. For a SOC Manager, it cuts noise and helps teams prioritize faster. 

Solution overview: simple automation, stronger operational signal 

The workflow runs on a schedule, queries Log Analytics, filters Arc health issues, formats the results into a clean HTML report, and sends a single email through Office 365 Outlook. The outcome is not more telemetry—it is a better operational signal. 

Prerequisites

• One or more Azure Arc-enabled servers connected to Azure.
• Azure Monitor Agent installed and sending heartbeat data to a Log Analytics workspace.
• Microsoft Sentinel enabled on the target workspace if the playbook is being used as part of SOC operations.
• A Logic App with permissions to run the query and send email through Office 365 Outlook.
• A reviewed threshold, recipient list, and notification cadence aligned to your operating model.

How the workflow creates decision-ready visibility 

In practice, this becomes a daily control: check Arc health, isolate persistent issues, and route one concise summary to the right teams. That gives the SOC a cleaner way to review monitoring gaps before they become bigger operational problems. 

Why this matters to a CISO and SOC Manager 

For security leadership, this is about confidence. If Arc health degrades on systems tied to monitoring, policy, or data collection, the risk is not just technical—it is a visibility gap. This playbook helps surface that gap early and in a form teams can act on quickly. 

Three practical scenarios where this playbook delivers value  

1. Reduce SOC noise.Replace scattered alerts with one daily summary.
2. Strengthen executive assurance.Highlight persistent blind spots before they turn into escalations.
3. Improve team coordination.Give security and infrastructure teams one shared view of the issue.

Sample KQL to identify persistent Arc monitoring gaps

This sample query uses the Heartbeat table to identify Azure Arc-connected machines whose latest heartbeat is older than the defined threshold. It is a practical starting point and can be tuned further based on the environment and data collection design.

let ThresholdTime = 30;
AzureActivity
| where TimeGenerated > ago(1d)
| where CategoryValue == "ResourceHealth"
| where parse_json(Properties).currentHealthStatus == "Unavailable"
| where ActivityStatusValue == "Active"
| extend ResourceType = Properties_d.resourceProviderValue
| where ResourceType == "MICROSOFT.HYBRIDCOMPUTE"
| extend StartTime = TimeGenerated
| extend ServerName = Properties_d.resource
| join kind=leftouter (
AzureActivity
| where ActivityStatusValue == "Resolved"
| extend ResourceType = Properties_d.resourceProviderValue
| where ResourceType == "MICROSOFT.HYBRIDCOMPUTE"
| extend EndTime = TimeGenerated
) on CorrelationId
| extend Minutes_OfflineTillResolve = datetime_diff('minute', EndTime, StartTime)
| project ServerName, StartTime, EndTime, CorrelationId, Minutes_OfflineTillResolve, Level, ActivityStatusValue1, ResourceGroup, OperationNameValue, SubscriptionId, ResourceProvider, Type, CategoryValue, ActivityStatusValue
| extend TotalMinutes_Offline = datetime_diff('minute', now(), StartTime)
| where TotalMinutes_Offline >= ThresholdTime and ActivityStatusValue1 !has "Resolved"
| order by TotalMinutes_Offline desc

Operational flow  

ARM Template: microsoft-security-operations-toolkit/Microsoft Sentinel/Automation/Playbooks/AzureArcServerMonitoring.playbook.json at 1e3aeff329e0d9b1d7caf2e4bfbc8476dfdb2ff2 · Abhishek-Sharan/microsoft-security-operations-toolkit 

Customization Ideas:

• Adjust the heartbeat threshold based on server criticality or business hours.
• Route summaries to different teams based on subscription, resource group, or server tags.
• Send notifications to Microsoft Teams in addition to, or instead of, email.
• Enrich the output with owner, business service, or environment metadata.
• Trigger incident creation only for high-priority or repeated visibility gaps.

Closing perspective 

The best SOC automations do not just collect signals—they create clarity. This playbook helps security teams spot Arc-related monitoring gaps early, reduce noise, and act with more confidence.