A permitting-desk analyst rewrites CIM Authentication filters by hand because using ES-shipped macros feels like cheating. What should the lead tell them?

Enterprise Security ships macros and saved searches that already encode CIM-aligned filters for domains such as Authentication, so a permitting-desk analyst is expected to reuse those named SPL resources rather than hand-rewriting equivalent regex for every civic investigation. Reusing ES-shipped macros is an intended SPLK-5001 skill: the macros centralize field logic, reduce copy-paste drift across the desk, and keep Authentication searches consistent with how notables and data models were designed. Hand-written regex is not required merely because macros feel like cheating, and macros are not reserved only for engineers—analysts investigating permitting-desk Authentication activity are meant to invoke them. Deleting the shipped macros so every city search is uniquely handcrafted destroys shared CIM filtering and forces every analyst to reinvent fragile expressions. Waiting for an ES admin to reinstall the app from scratch before macros are "allowed" is administrative theater that delays investigations without changing the fact that reuse is already supported. Exam caveat: knowing that macros and saved searches are legitimate, reusable SPL assets is distinct from inventing new CIM mappings or performing ES Admin install work. Operational check: from a permitting Authentication hunt, invoke the relevant ES-shipped Authentication macro or saved search, confirm it returns CIM-normalized events for civic identities, and compare that result set to any hand-rolled filter to verify the macro path is complete and preferred.