Adding create DCR step in Syslog tutorial

Author: limwainstein

articles/sentinel/forward-syslog-monitor-agent.md

@@ -48,6 +48,12 @@ To complete the steps in this tutorial, you must have the following resources an
    - [Create a Linux VM in the Azure portal](/azure/virtual-machines/linux/quick-create-portal) or [add an on-premises Linux server to Azure Arc](/azure/azure-arc/servers/learn/quick-enable-hybrid-vm).
 - A Linux-based device that generates event log data like a firewall network device.
 
+## Create the DCR and add resources
+
+To create the DCR and add resources, follow the steps in these articles:
+- [Create the data collection rule](/azure-monitor/vm/data-collection#create-a-data-collection-rule)
+- [Add resources](/azure-monitor/vm/data-collection#add-resources)
+
 [!INCLUDE [configure-syslog-ama](~/reusable-content/ce-skilling/azure/includes/azure-monitor/agents/configure-syslog-ama.md)]
 
 For the full procedure of configuring Syslog data collection, see [Collect Syslog events with Azure Monitor Agent](/azure/azure-monitor/agents/data-collection-syslog).