It all depends on the available data and the variety of activities. You can’t just pour a bunch of data into an ML model and expect it do detect threats. In many cases, the key is to combine human analysts with ML algorithms.

https://bdtechtalks.com/2019/07/29/machine-learning-ai-cybersecurity/