diff --git a/rules/proxy/proxy_cobalt_ocsp.yml b/rules/proxy/proxy_cobalt_ocsp.yml
index e57a85e6a..d657963aa 100644
--- a/rules/proxy/proxy_cobalt_ocsp.yml
+++ b/rules/proxy/proxy_cobalt_ocsp.yml
@@ -16,7 +16,7 @@ logsource:
     category: proxy
 detection:
     selection:
-      c-uri: '*/oscp/*'
+      c-uri|contains: '/oscp/'
       cs-host: 'ocsp.verisign.com'
 
     condition: selection