Detection to response coupling
Detection to response coupling is how directly a response platform receives detections from EDR, identity, email and cloud tools, without a SIEM in front. Tight coupling removes a hop and its delay. A platform that is itself a SIEM or XDR is coupled by design.
Definition
If the platform takes alerts only through a SIEM, the SIEM's latency and rule quality set the floor on time to contain.
Webhook and connector ingestion is a middle case. It works, but the page should say which sources it takes directly.
Detection to response coupling in Swimlane's documentation
Swimlane's Turbine page says customer detection logic alerts flow into the same routing model as alerts from SIEM, EDR and cloud security tools, so a SIEM is not stated as required. vendor claim Source: swimlane.com/swimlane-turbine · Read
The example names a vendor and its own page. A vendor's use of Detection to response coupling may differ from the definition above; the rubric uses the definition on this page.