Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain actions?
IOCs are breadcrumbs attackers leave and organizations gather up to share with each other. There are atomic indicators in an IOC like IP, port #, username, filename, etc that you can configure your IPS to reject.
There are host-based or network-based indicators. Because of all the types of IoCs, your IPS won't be the only tool you use to guard against attacks, though a good one of course.
This article from FireEye on OpenIOC will help anyone who wants to better wrap their mind around the types and parts of an IOC, using this framework as a specific example.