"If you see the string 'HaXoRTeam', you should look into it", whether that string might appear in an Email Header, a PE import, a DNS record, or the author of a Word document. That string can be fed into a variety of signature engines (Snort, Yara, etc.) where it can be useful, and also used to say "we saw this string in a couple different contexts in different incidents, so those incidents could potentially be related."
For example, in the context of STIX:
"If you see the string 'HaXoRTeam', you should look into it", whether that string might appear in an Email Header, a PE import, a DNS record, or the author of a Word document. That string can be fed into a variety of signature engines (Snort, Yara, etc.) where it can be useful, and also used to say "we saw this string in a couple different contexts in different incidents, so those incidents could potentially be related."