The set of modulations available under the SFZ1 specification is fixed, and there's a dedicated opcode for every possible modulation, including fairly esoteric ones such as using note velocity to modulate the hold stage of the pitch envelope.
Basic MIDI CC modulation
For example, this would have a sample offset of 500 when the modulating CC is at 0, and a sample offset of 1000 when the modulating CC is at max:
It's also possible to just specify the modulation, in which case the default value is what will be modulated. The defaults for offset, delay and EQ band gain are 0, so this would result in the offset being modulated between 0 and 1000:
Modulating default values
The three EQ bands' frequency, bandwidth and gain work similarly, but also add velocity tracking. The EQ bandwidth and center frequency also have non-zero defaults, for example eq2_freq is 500 if not specified. So, this would modulate the center frequency of the second EQ band between 500 and 1500 if eq2_freq is left at default:
Velocity tracking, keytracking and randomization
<region>sample=e4_ft_p.wav xfin_locc1=0 xfin_hicc1=63 xfout_locc1=64 xfout_hicc1=127
<region>sample=e4_ft_f.wav xfin_locc1=64 xfin_hicc1=127
In addition to MIDI CC, crossfades can also use MIDI note number and velocity as modulation sources, and the xf_cccurve, xf_keycurve and xf_velcurve give the choice of two curves for each of these modulations.
More sophisticated modulations are possible with volume, pitch and filter cutoff. Volume and cutoff can be modulated by MIDI CC directly (pitch can't in SFZ1 - the tune_ccN modulation is an ARIA extension). All three can also have randomization applied and be modulated by MIDI note number and velocity. The nomenclature for volume is a little confusing, with gain_ccN using "gain" in the name, while the others are called amp_random, amp_keytrack and amp_veltrack.
LFOs and envelopes
Volume, filter and cutoff also each get an LFO and an envelope. The LFO rate and depth can be modulated by MIDI CC. Each LFO also has a simple envelope with delay and fade, but modulating the duration of these is not allowed under the SFZ1 spec (though it is with SFZ2 LFOs). Here's a typical pitch vibrato LFO:
Each envelope parameter can also be modulated by CC, or by velocity. Here's a exmple setup for a synth-style ADSR volume envelope (hold is not specified so the default hold value of 0 is used) controlled by CCs and some initial minimum values set for attack and release, along with a default sustain of 0:
Modulating envelope parameters with velocity allows, for example, setting up a filter on an acid bass which will sweep farther with higher velocity, and also sweep faster.
If something is not described above, then modulating it is not possible under the SFZ1 specification, and will require using SFZ2 or possibly some extension opcodes.