I broke out your two questions and handled them separately:
How can I assign the same incident to a different owner ( Analyst 2) to perform second level investigation by capturing every thing the first level analyst did so far .
You can re-assign the case in Incident Review (though I'm sure you already know that). The notes from the previous Analyst are not included in the new status but the previous history of the incident still exists. You can see the history of the incident by viewing it on the Incident Review page, showing the details, and clicking "View all review activity for this Notable Event".
Secondly, is there a way to find out metrics about how long the first level analyst took to resolve or re-assign the notable event to a 2nd level support and also to find how long it took to resolve and close the notable events by both the 1st/2nd and 3rd level security analysts?
Viewing all activity of a notable event will give you an idea of the lifecycle of the incident. That said, while it does display the history of the events, it doesn't currently display the amount of time it was in that state. Feel free to open an enhancement request if you want that, it probably wouldn't be too hard to implement.
... View more