Best practices: SIEM behind air-gap

We’re currently operating a development network for ~30 Devs (all Linux machines, 3 locations) disconnected from other networks. To allow for limited communication with other networks we need to have some kind of SIEM. There’s currently no log-management at all.

What would your recommendations be for tools&setup for network of that scale without needing internet? Elastic-security and Graylog seem to need internet by default.

best practices cybersecurity gap practices siem