1. A computer-implemented method, comprising: under the control of one or more computer systems that execute instructions, determining a set of introspection points in a distributed computing system of a computing resource service provider, the set of introspection points having a first type of introspection point and a second type of introspection point determined based at least in part on a type of identifying characteristics accessible at individual introspection points of the set of introspection points; measuring, at the individual introspection points, the identifying characteristics; generating a graph representing a set of nodes based at least in part on the identifying characteristics measured, with individual nodes of the set of nodes corresponding to individual elements of the distributed computing system, and edges in the graph corresponding to measurements of the identifying characteristics correlating the individual elements to other individual elements; and evaluating a rule based at least in part on the graph by at least: determining that one or more measurements that correlate an individual element to another individual element in the graph are in noncompliance with the rule; and performing a security action based at least in part on the noncompliance.