Relationships among incident-addressing steps, applications, and incidents are determined, based on information relating to the applications and the incidents. For addressing a given incident that occurred with respect to a particular application, at least one incident-addressing step is identified using the determined relationships.