1. A method comprising: determining, by a system having a processor, geometric relationships among incident-addressing steps, clusters of applications, and clusters of incidents, based on information relating to the applications and the incidents, wherein each of the clusters of applications includes a respective plurality of applications, and each of the clusters of incidents includes a respective plurality of incidents; for addressing a given incident that occurred with respect to a particular application, identifying, by the system, at least a first incident-addressing step using the determined geometric relationships, wherein the first incident-addressing step is identified based on determining that the first incident-addressing step is a closest of the incident-addressing steps to an application cluster including the particular application and to an incident cluster including the given incident, the application cluster being one of the clusters of applications, and the incident cluster being one of the clusters of incidents; and updating, by the system, the information based on performance of the identified at least first incident-addressing step, wherein the updated information is for subsequent use in identifying an incident-addressing step for another incident.