I am guessing you are referring to the Active Scanner feature of Zap. The active scanner first looks at the discovered site nodes on the left side panel. So before running the active scan, you first want to populate those site nodes. You can do this with the spider, forced browsing (i.e. dirbuster), or manual browsing with the proxy. Then, once those nodes are populated you want to manually review them and adjust them if necessary.
From https://www.zaproxy.org/docs/desktop/start/features/structmods/ :
“The Sites tab show ZAP's representation of the application.
If it is not a good representation of the structure then ZAP will not be able to attack the application effectively.
There are currently 2 types of Structural Modifiers:
* Data Driven Content which identify URL paths that represent data
* Structural Parameters which identify parameters that represent application structure instead of user data”
To adjust the structure of the Sites tab in order to Zap to attack it efficiently you must define contexts around the nodes, to group them or split them.
Grouping the data driven ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/ddc/
Splitting the structural ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/structparams/
Then, once the Sites tab is structured in a logical way, you can begin your attack. My understanding is that in the Sites tab, the nodes defined as structural will be treated as such, so will be using the “real” key,value pairs defined by the site, whereas the nodes flagged as data will be treated as payload input vectors. The Active Scan might still try tampering with the structured parameters to look for certain vulnerabilities, but most of the tampering should be on the data parameters I believe.
Also, with the Zap Fuzzer feature, you can control which locations are fuzzed, such as a particular parameter you want to tamper with. Read more about that here: https://www.zaproxy.org/docs/desktop/addons/fuzzer/
You might also be interested in the FuzzDB Files addon: https://www.zaproxy.org/docs/desktop/addons/fuzzdb-files/
This guide is also worth checking out: https://medium.com/volosoft/running-penetration-tests-for-your-website-as-a-simple-developer-with-owasp-zap-493d6a7e182b
Hope I answered your question, or at least pointed you in the right direction.