A validated hunt returns too many columns. The analyst wants only device, account, and timestamp fields without changing which rows match. Which operator fits?

1. where
2. project
3. summarize
4. join