1) Yes. There are many built-in correlation searches ("rules").
2) From the Enterprise Security app, go to Configure->Content Management, click the green button, and select "New Correlation Search".
3) There are no free courses for Enterprise Security.
4) The Risk Analysis panel is used for analyzing risk. For most correlation searches, a successful search will assign a risk score to the assets and/or identities found. The RA dashboard is used to study the assets and identities which have risk scores.
6) Contact for your Splunk Account or Sales team for ES license cost. The cost is directly related to the volume of data your Splunk environment ingests.
7) Splunk calls alarms "alerts". In any search panel, create a search for the event(s) for which you want an alert. When you have a working search that produces the desired results, click the Save As link and select Alert.
--- If this reply helps you, an upvote would be appreciated.