Does it need to be inline?

Or can it work from a span port?

It is meant to be inline to provide the protection it offers, but can work from a span port for monitoring purposes only.