Here's a past livestream with Chris Brenton where he shows how to go through PCAP files with Zeek. https://www.youtube.com/watch?v=Jd80NfBVAcU

Join Chris June 6-9 for his Pay-What-You-Can class, "Getting Started in Packet Decoding"! Details and registration here: https://cvent.me/D0Dlmg?RefId=ANTI009_MD