Yes, an Alert Logic® Threat Manager™ appliance is required for a customer to collect threat traffic. Threat Manager appliances are able to collect network traffic either directly from a span (mirrored) port from a network switch or from Threat Manager agents, which can be deployed on any host that you wish to protect.
In the case of span ports, network traffic can only be sent to an appliance that is sitting locally to the network switch. Similarly, agents can only send network traffic to a local Threat Manager appliance.
Threat Manager appliances come in both physical and virtual (.ova) options. Physical appliances are able to work with both agents and network spans, while virtual appliances only work with agents.