Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain actions?
After reading your follow up comment - yes, you can and should read news to use indicators published. However, discovering and actioning an IoC yourself is also very important.
The 'Pyramid of Pain' outlines different types of indicators, and groups them by the ease with which an attacker can change them. For example, a hash published in threat intel or VirusTotal can be altered very quickly by an agile attacker. Using a sandbox can provide you agility to meet fast changing threats.
Additionally, some victims may not want the IoC they discovered and blocked to be shared. If it is very targetted malware, the risk of someone publishing the IoC can mean the attacker then alters their TTPs and the victim will need to start all over again (detect and block another IoC).