> Don't dumb it down
Where was that demanded?
> It is exceedingly easy to filter the output of said tools.
This is provably false. Consider the content of Linux file systems. There is no one tool to simultaneously observe conventional POSIX properties, ACLs, capability attributes, selinux properties, AppArmor references, etc., to which you might apply a filter. So you have to repeatedly create your own, half-baked, inefficient, throw-away correlation tools on the fly in what little time you can spare.
Why? These features didn't appear last week. Most are older than a lot of people coping with this stuff. I answer that question here[1].