IOCs, ATT&CK, hunting and the intel program.
A hash on its own is a coin flip. A hash that a crew used against three hospitals last month, delivered the way this email was delivered, is a call you can make and defend. Intel work is collecting that context before the alert lands, and writing it down so the next analyst does not start from zero.