I have been tasked with standing up UBA for our organisation, and the amount of vendor marketing around this makes it difficult to work out where to begin.

From what I can tell, the first real step is establishing a behavioural baseline, normal login times, typical data access patterns, and similar activity, before you can meaningfully identify anomalies. My understanding is that this takes a few weeks or even months of baseline data before the alerts become genuinely useful.

The other thing I keep hearing about is alert fatigue. Every vendor demo shows a handful of high-confidence alerts, but practitioners describe the first year very differently, with plenty of false positives while the baseline matures. If analysts are not expecting that, they quickly lose confidence in the system.

For teams that have already rolled this out, how long did it realistically take before the alerts were reliable enough to investigate without manually validating almost everything?