A hunt should examine only process events from the last 24 hours. Which KQL operation applies the required time restriction?

1. order by Timestamp desc
2. project Timestamp
3. where Timestamp > ago(24h)
4. take 24