A ZAP instance count is not a host count

The count is the size of the group

ZAP can show one alert name and a number of instances. That number is how many instances the rule grouped. It does not list the URLs, and it does not count hosts. Four instances are four instances until you open them.

The lab report from a baseline against http://127.0.0.1:3000 is the place to practice this. The count is still a count on that report. It is not a score for some other site.

Hosts come from the instance URLs

When you expand the group, each instance has a URL. The host is the host in that URL. Four paths on 127.0.0.1:3000 are one host. A different host would be a different name in a URL you actually opened.

If you leave the group closed, write that the instance URLs were not opened. Do not fill them from the site tree, and do not add a public hostname because the number looked serious.

What the note is allowed to say

File the rule name, the instance count, and each URL you opened. Say how many distinct hosts those URLs contained. A sentence about “four hosts” needs four host names on the page. This reading does not launch another scan.

Worked case: four lab paths called four hosts

On a Harbor Ledger baseline report, one alert name shows 4 instances. You open them and every URL is on http://127.0.0.1:3000, with four different paths. A draft says four hosts were affected.

The note says four instances, one host, and lists the four paths. No other host is added. The draft’s host count is replaced with the host that was actually in the URLs.

target of the report: http://127.0.0.1:3000
instances: 4
hosts in those URLs: 127.0.0.1
write: four paths, one host
not: four hosts