This depends on where you are creating event rules:

• Global rulesets: Email filters/rules are supported. Custom event transformers are not supported, however, global event rules will autodetect and transform events sent to a global endpoint.
• Service Event Rules: Only basic email filters are supported, while email rules are not supported. Custom event transformers are supported.

• Events that are routed are transformed into CEF.
• Global Rulesets: Custom Event Transforms (CETs) are not supported.
• Service Event Rules: Custom Event Transforms (CETs) are supported.

• Global Rulesets: Any events that are sent through event rules and do not match any rules are suppressed, and you can find them in the alerts table. You can change this default behavior by editing the catch-all rule at the bottom of your rules list.
• Service Event Rules: Any events that are sent through service event rules and do not match any will turn into incidents and will not be suppressed.

Yes. You can leverage the Rulesets API to allow this functionality.

Yes. Service event rules can be used in conjunction with your global event rules this way.

If a second event with the same incident key is passed and de-duplicated into the open incident via global, team, or service event rules, the actions are not followed (ie. raising priority, adding a note) except for when severity is raised.

As emails are processed, the email subject will be used as a default deduplication key. In other words, emails with the same subject line will automatically be deduplicated. To change this behavior, add a custom deduplication key with an event rule action.

Yes, global event rules are written against raw/untransformed events, whereas service event rules are written against transformed/PD-CEF events.

If there is an existing unresolved alert with the same dedup key as the incoming event, this event will be deduped into that alert and the "suppress" action in the event rules will be ignored.