we been tasked with standing up uba for our org and the amount of vendor noise around this makes it hard to figure out where to begin. so from what i can tell the real first step is establishing a behavioral baseline (normal login times, typical data access patterns, and so on) before you can flag anything as anomalous, which means you need a few weeks or months of clean data before the tool is doing anything useful.

also the other thing i keep running into is alert fatigue. every uba vendor demo shows a clean dashboard with a handful of high confidence alerts, but from what people tell me the reality in year one is a flood of false positives while the baseline tunes itself, and if your analysts aren't prepared for that they tune the whole thing out. for anyone who's run this rollout, how long did baselining realistically take before the alerts became trustworthy enough to act on without double checking everything manually?