Getting hundreds of failed login attemps from our solarwinds VM to all other servers and VMs. This is not normal, right?

Hi, I recently joined a firm and we are in process of implementing SIEMs and IDPS and the very first thing we notice is that there are hundreds of login attempts coming from our solarwinds VM to our all other servers which include our email server, file server, etc.

Obviously the working theory is that the machine is compromised and whatever hacker/malware is in there is trying to expand to other systems via brute force, but since I haven't worked …

coming cybersecurity idps joined login login attempts normal notice process servers solarwinds vms