From 9183e25e16f01d8155d71c4500adb9e33c5495b9 Mon Sep 17 00:00:00 2001
From: Justin Ryburn <justin@ryburn.org>
Date: Thu, 22 Feb 2024 12:53:28 -0600
Subject: [PATCH] Update readme

---
 README.md | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index db22efd..aa521e3 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,30 @@ This event source plugin from Kentik accepts alert notification JSON and works i
 * Ansible Automation Platform with EDA Controller instance
 
 ## Example rulebook
-TODO
+```
+---
+- name: Listen for alerts using kentik_webhook
+  hosts: all
+
+  ## Define our source for events
+
+  sources:
+    - kentik_webhook: # for local tests only. In production use kentik.ansible_eda.kentik_webhook
+        host: 0.0.0.0
+        port: 80
+
+  ## Define the conditions we are looking for
+
+  rules:
+    - name: Print out the alert
+      condition: event.i == 1
+
+      ## Define the action we should take should the condition be met
+
+      action:
+        run_playbook:
+          name: playbooks/example_playbook.yml
+```
 
 ## Licensing
 We are using GPL 3.0 as our default.