From c782013053e38f7549325439e6ac21799c0e3300 Mon Sep 17 00:00:00 2001
From: bcoles <bcoles@gmail.com>
Date: Sun, 29 Oct 2023 22:53:18 +1100
Subject: [PATCH] sfp_webanalytics: Add match for Google Tag Manager

---
 modules/sfp_webanalytics.py | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/modules/sfp_webanalytics.py b/modules/sfp_webanalytics.py
index 46b24d59a3..a8c55fac41 100644
--- a/modules/sfp_webanalytics.py
+++ b/modules/sfp_webanalytics.py
@@ -97,6 +97,22 @@ def handleEvent(self, event):
                 evt.moduleDataSource = datasource
                 self.notifyListeners(evt)
 
+            # Google Tag Manager
+            matches = re.findall(r"\b(GTM-[0-9a-zA-Z]{6,10})\b", eventData)
+            for m in set(matches):
+                if m.lower().startswith('GTM-XXXXXX'):
+                    continue
+
+                self.debug(f"Google Tag Manager match: {m}")
+                evt = SpiderFootEvent(
+                    "WEB_ANALYTICS_ID",
+                    f"Google Tag Manager: {m}",
+                    self.__name__,
+                    event
+                )
+                evt.moduleDataSource = datasource
+                self.notifyListeners(evt)
+
             # Google Website Verification
             # https://developers.google.com/site-verification/v1/getting_started
             matches = re.findall(r'<meta name="google-site-verification" content="([a-z0-9\-\+_=]{43,44})"', eventData, re.IGNORECASE)