How can I determine TLS version of hosts using Splunk Stream?

All, I want to scan a PCI zone off a network tap. Determine what TLS version is flowing and alert on anything less than 1.2. I don't need the body of the bits. Anyone have a talk through on how I might do this with Splunk Steam? First time I am trying this.