steps:
    - name: Query ilert
      provider: ilert
      config: "{{ provider.my_provider_name }}"
      with:
        incident_id: {value}  

actions:
    - name: Query ilert
      provider: ilert
      config: "{{ provider.my_provider_name }}"
      with:
        _type: {value}  # Type of notification ('incident' or 'event') - determines which endpoint is used
        summary: {value}  # A brief summary of the incident (required for new incidents)
        status: {value}  # Current status of the incident (INVESTIGATING, RESOLVED, MONITORING, IDENTIFIED)
        message: {value}  # Detailed message describing the incident (default: empty string)
        affectedServices: {value}  # JSON string of affected services and their statuses (default: "[]")
        id: {value}  # ID of incident to update (use "0" to create a new incident)
        event_type: {value}  # Type of event to post (ALERT, ACCEPT, RESOLVE)
        details: {value}  # Detailed information about the event
        alert_key: {value}  # Unique key for event deduplication
        priority: {value}  # Priority level of the event (HIGH, LOW)
        images: {value}  # List of image URLs to include with the event
        links: {value}  # List of related links to include with the event
        custom_details: {value}  # Custom key-value pairs for additional context