Validate log collection for LDAP Server events - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

From the Start menu, open Event Viewer.

Go to Application and Services Logs → Directory Service.

Filter for Event ID 1644.