Munin, Keeper of LoreOh no.
He's doing the configuration and SIEM management from the domain controller.
He is -logged in- to the domain controller and is doing the configuration of the SIEM system -from- the UI of the domain controller.
Oh dear.
The SIEM is running via Hyper-V....ON THE DOMAIN CONTROLLER
The DC is running bare-metal, and is hosting Hyper-V instances beneath it.
How is that configuration even -allowed-?