SecOps/Chronicle stores its audit logs in Cloud Logging. Details available here: https://cloud.google.com/chronicle/docs/administration/audit-logging

-mike

Thanks for your reply 
How i can forward them to chronicle ? i want to make rules based on audit logs
Thanks

If you use the native GCP log collection you'll get Chronicle API Admin audit logs automatically, e.g., rule creation, deletion. 

To collect data access logs, e.g., users running a Search for X, you'll need an additional filter:

 We have an example Blog series on this topic available here:

https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Unexpected-Rule-Changes-in-Google-Security/ba-p/810901