What does the risk framework add to an object (user, server or other type) to indicate increased risk?

To which of the following should the ES application be uploaded?

An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

Which component normalizes events?

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.
What data model should be checked for potential errors such as skipped searches?