A permitting-desk analyst rewrites CIM Authentication filters by hand because using ES-shipped macros feels like cheating. What should the lead tell them?
Select an answer to reveal the explanation.
Short Explanation
Using the macros that shipped with ES is the point, not a shortcut around the exam. Those macros already know CIM Authentication filters so the permitting desk does not reinvent them. Rewriting by hand is unpaid duplication.
Full Explanation
Enterprise Security includes macros and saved searches as named SPL resources. Analysts are expected to reuse them rather than re-author CIM filters for every civic investigation. That reuse is in-scope for SPLK-5001; writing custom regex because macros feel like cheating is not required. Deleting shipped macros or waiting on an ES reinstall is admin theater and works against consistent Authentication searches.