4802 Security log · Logon/Logoff info severity high volume

SecurityEvent
| where EventID == 4802   // The screen saver was invoked
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4802
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The screen saver was invoked — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4802 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked