I'm not familiar with snort. However, the snort documentation gives this example:
alert tcp any any -> 192.168.1.1 80 ( msg:"A ha!"; content:"attack"; sid:1; )
The structure is:
action proto source dir dest ( body )
It also states, that:
source - specifies the sending IP address and port, either of which can be the keyword any, which is a wildcard.
dir - must be either unidirectional as above or bidirectional indicated by <>.
dest - similar to source but indicates the receiving end.
There is no indication made, that you can match multiple ports at once. I'd therefore try the following rules:
alert tcp any any -> any 443 ( msg:"Sample alert 443"; sid:1; rev:1; )
alert tcp any any -> any 447 ( msg:"Sample alert 447"; sid:2; rev:1; )
Edit: If your question was how to achieve this in one rule, you might want to try:
alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1; rev:1; )
You will also probably find this site useful.