Concepts

Zone

A registrable domain you asked ZoneInsight to watch. Everything discovered about it — nameservers, mail hosts, addresses, prefixes, ASNs, certificates, registrar — hangs off the zone as an asset graph.

Observation

One measurement, made by one probe, at one instant: “the A records for example.com, as resolved from eu-fra at 14:02:11Z”. Observations are signed by the probe that produced them and are never edited. A failed or inconclusive check is recorded as such and is explicitly not treated as a change.

Change event

A difference between what was known and what a conclusive observation now shows — a nameserver added, a DS record removed, a certificate replaced. Each carries a baseline severity and its own review state.

Incident

Related change events inside a correlation window that together match a risk pattern — a possible domain takeover, a routing anomaly, a mail-interception risk. An incident has a severity, a confidence, and an explanation listing the indicators that fired. This is the unit you review; six technical facts arrive as one item, not six alerts. See Changes & incidents.

Checkpoint & evidence bundle

Observations are batched, Merkle-rooted, and committed on a fixed cadence to a public chain. An evidence bundle packages one observation with its signature and the inclusion proofs linking it to a committed root — verifiable by anyone, offline, with no ZoneInsight account. See Evidence & verification.