Packet Analysis for Threat Hunting

To all the Packet heads and Threat Hunters out there, what is the general flow you have when initially investigating captures or live traffic? Brim, zeek, snort, wireshark? Or do you run them through a SIEM like security onion or splunk?

Just wanting to stir up some conversation and learn how others approach the task.

Edit: the questions mostly for individual fun or practice cases. Feel free to add business cases too! All are good to know!

analysis brim conversation cybersecurity flow general hunters hunting learn live onion packet run security siem snort splunk stir task threat threat hunting traffic what is wireshark zeek