it's a (possibly virtual) appliance. It has connection to the intercept engine sitting somewhere in-band.