How to exclude port range(0-1024) in correlation rule?
Create a watching list with the "Regular Expression" checked and add the following value in your watchlist.
In the filter of you rule, select "NOT IN Watchlist" and select the watchlist you have created. Thats it. It should work.
Hope this helps.
Retrieving data ...