Certificate Transparency monitoring polls crt.sh for each configured domain. Any certificate issued by an unknown CA triggers an alert — useful for detecting domain compromise or mis-issuance.