Take a look at this search from the _internal index:
index=_internal sendemail sourcetype=itsi_internal_log
And you should see the search that ITSI is running. That will look something like this:
2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action]  Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$
Execute the generated search command and that will show you the fields that are available.
Each of the notable events is generated either by a correlation search, multi-kpi alerts, grouping event or alert action. Each one of this carries different $result.fieldnames$.
For the correlation searches and multi-kpi alerts you can check the fields available and their names by executing the search that generated the notable event (Go to Configure -> Correlation Searches and copy the Search string defined).
Also you can check the fields avilable in both the itsitrackedalerts and itsigroupedalerts indexes. Both of then store the notable events generated by ITSI.
index=itsi_grouped_alerts OR index=itsi_tracked_alerts