1. A method comprising: determining, by a system having a processor, relationships among incident-addressing steps, applications, and incidents, based on information relating to the applications and the incidents; for addressing a given incident that occurred with respect to a particular application, identifying, by the system, at least one incident-addressing step using the determined relationships; and updating, by the system, the information based on performance of the identified at least one incident-addressing step, wherein the updated information is for subsequent use in identifying an incident-addressing step for another incident.