Any way to get the last times the screen was unlocked in macOS?
It appears different versions of macOS use different logs to repersent this. None of which, I have found, show a different log for a "login" or an "unlock". I have answered the next best thing: How to find all logins/unlocks. The following terminal commands will show you the date in time in which a login or unlock occurred.



With the help of this answer, and spending an hour looking through logs I figured this out:

P.S. You can additionally use the helpful --last tag to limit to a specific time relative to now. For example --last 5m would only be the last 5 minutes, --last 5h would be the last 5 hours, and --last 5d would be last 5 days.



macOS Mojave

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider activate]_block_invoke"


Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider activate]_block_invoke.



Check for valid unlock attempts (Valid password or Touch ID):

 log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke"


Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke.



macOS High Sierra

WIP

Check for blocked unlock attempts (Invalid password or Touch ID):

...



Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke"




macOS Sierra

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "Verify password called with PAM auth set to YES, but pam handle == nil"




Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "SecKeychainLogin result: 0, password was supplied"