Detection from UBA is often ignored or not promptly acted on. What procedures and technology are required to insure an effective UBA program? Let’s discuss as a community what works for and get agreement on what an effective program should be. Do we investigate every anomaly? What is the appropriate monitoring and response? What are common problems or limitations?