How does CybOX data is generated?

[alexander kipnis <alexander.kipnis85@gmail.com>]

Hi,

I am new to the field.

I have read the whitepapers of STIX and CybOX, and currently trying to understand from what data cyber analysts craft the CybOX observables?

For example, do they have an IDS system or a phishing detection system from which they extract the observables and then create patterns?

It seems like a chicken and egg problem, when one of the main use cases of STIX and CybOX is to create patterns for observables.

Thanks,

Alexander Kipnis