One way I have done to achieve this is to define a "Call" process in front of the incident process. As soon as the service desk has defined that the call is an incident the ordinary "incident" process is created and the call process is closed. The incident process is set in an "accepted as incident" state ( creation date"
Either Servicedesk goes on working with the incident ( the it is set to "working".
If Service desk can not solve the incident right away it is escalated the "second line".
These dates are defined in a "call"
A service desk often has 2 sla response time to response whether the call is generated via phone(direct), portal or mail (Indirect)
- Creation Time ( Start of sla response time)
- Start of defining type of call Time (End of call response sla)
- Close Time ( End of define type if call time)
- Call is breached if the response time has failed
If the call ends up being an incident.
- Creation time ( Start of Incident sla)
- Functional escaltion time ( First assignment outside Service desk( second line), Defined attribute calculated with calculation)
- Latest Resolve time ( End of Incident sla time)
- Incident is breached if the incident resolve time is breached
This way I have all the dates I need to report in the incident table and can easily access these with a query.
I have used the call domain sometimes to do the call management. The downside of using Incident as a domain of call management is that he underlying incident becomes an child incident. The good thing is that in 7.4 the "call" can be "transformed" to an incident. The only thing to bare in mind is that the former process (call) is not there any more. So the decision to use one or two domains is more up to what You want to save for reporting purposes.
Surely this can be done in many other ways.
Hope I can give You some ideas to reach your goal.