Take a look at this search from the _internal index:
index=_internal sendemail sourcetype=itsi_internal_log
And you should see the search that ITSI is running. That will look something like this:
2019-07-09 11:53:02,134 INFO [itsi.controllers.itoa_rest_interface_provider] [notable_event_actions] [execute_action] [9969] Generated search command= search itsi_event_management_group_index itsi_group_id="5a5eb01b-0a1a-45ac-b4c5-15696d3ac9ad" | dedup itsi_group_id | itsi_notable_group_lookup | sendemail "email" subject="$result.itsi_group_description$" message="$result.service_name$ is currently in $result.severity_label$ with a value of $result.severity_value$ at $result.actual_time$
Execute the generated search command and that will show you the fields that are available.
... View more