1. A computer-implemented method, comprising: under the control of one or more computer systems configured with executable instructions, obtaining a measurement at a point in a distributed computing environment; determining, based at least in part on the measurement, a correlation between a first element in the distributed computing environment and a second element in the distributed computing environment; generating, based at least in part on the correlation, a graph comprising a plurality of nodes, with a first node of the plurality of nodes associated with the first element and a second node of the plurality of nodes associated with the second element; determining, from the graph, that the measurement is in noncompliance with a rule; and triggering a security action based at least in part on the noncompliance that was determined.