From 0373676c3952baf54b8ce14f67d104d3222690a9 Mon Sep 17 00:00:00 2001
From: bcoles <bcoles@gmail.com>
Date: Mon, 30 Oct 2023 18:04:02 +1100
Subject: [PATCH] sfp_webanalytics: Add match for Google Tag Manager (#1816)

---
 modules/sfp_webanalytics.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/sfp_webanalytics.py b/modules/sfp_webanalytics.py
index 46b24d59a3..a8c55fac41 100644
--- a/modules/sfp_webanalytics.py
+++ b/modules/sfp_webanalytics.py
@@ -97,6 +97,22 @@ def handleEvent(self, event):
                 evt.moduleDataSource = datasource
                 self.notifyListeners(evt)
 
+            # Google Tag Manager
+            matches = re.findall(r"\b(GTM-[0-9a-zA-Z]{6,10})\b", eventData)
+            for m in set(matches):
+                if m.lower().startswith('GTM-XXXXXX'):
+                    continue
+
+                self.debug(f"Google Tag Manager match: {m}")
+                evt = SpiderFootEvent(
+                    "WEB_ANALYTICS_ID",
+                    f"Google Tag Manager: {m}",
+                    self.__name__,
+                    event
+                )
+                evt.moduleDataSource = datasource
+                self.notifyListeners(evt)
+
             # Google Website Verification
             # https://developers.google.com/site-verification/v1/getting_started
             matches = re.findall(r'<meta name="google-site-verification" content="([a-z0-9\-\+_=]{43,44})"', eventData, re.IGNORECASE)