Try something like this:
Select *, "NEXT_TSTAMP" - "EVENT_TIMESTAMP" As "DURATION"
From (
Select *, lead("ACTION") OVER (Partition By "ACTOR" Order By "EVENT_TIMESTAMP") As "NEXT_TSTAMP"
From audit_events
Where .......
) subq
Where "ACTION"='login'
Order By EVENT_TIMESTAMP
The last login, if not yet logged out, will have nulls for NEXT_TSTAMP and DURATION.