The stream or block algorithm to use as cipher for keeping messages confidential is negotiated during the TLS handshake. It is part of the so called cipher suite. A list of cipher suites are send during the "Client Hello" message of the handshake, after which the server chooses one of them during the "Server Hello" initial message.
Nowadays they are generally used in an authenticated mode of operation such as AES-GCM (where AES is the block cipher and GCM mode defines how it is used and how the messages are authenticated) or ChaCha20/Poly1305 (where ChaCha20 is a stream cipher and Poly1305 indicates how the authentication tag is calculated).
It depends on the TLS protocol version what the cipher suite string looks like; for instance you'd have
TLS_ECDHE_RSA_AES_256_GCM_SHA384 for TLS 1.2 and
TLS_AES_256_GCM_SHA384 for TLS 1.3 for comparable operation. Note that in reality these cipher suites are indicated using two bytes in the handshake itself; the cipher suite strings are generally only used as constants in applications or as configuration options of applications.
Note that the AES_256 is obviously the same as AES-256, i.e. AES with a 256 bit key size (and 14 rounds of operation). Also note that OpenSSL unfortunately also allows their own cipher suite strings to identify the same cipher suites.