diff --git a/meta-security/lib/oeqa/runtime/cases/apparmor.py b/meta-security/lib/oeqa/runtime/cases/apparmor.py
new file mode 100644
index 0000000..e2cb316
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/apparmor.py
@@ -0,0 +1,27 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class ApparmorTest(OERuntimeTestCase):
+
+    @OEHasPackage(['apparmor'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_apparmor_help(self):
+        status, output = self.target.run('aa-status --help')
+        msg = ('apparmor command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['apparmor.ApparmorTest.test_apparmor_help'])
+    def test_apparmor_aa_status(self):
+        status, output = self.target.run('aa-status')
+        match = re.search('apparmor module is loaded.', output)
+        if not match:
+            msg = ('aa-status  failed. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
diff --git a/meta-security/lib/oeqa/runtime/cases/clamav.py b/meta-security/lib/oeqa/runtime/cases/clamav.py
new file mode 100644
index 0000000..fc77330
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/clamav.py
@@ -0,0 +1,38 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class ClamavTest(OERuntimeTestCase):
+
+    @OEHasPackage(['clamav'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_freshclam_help(self):
+        status, output = self.target.run('freshclam --help ')
+        msg = ('freshclam --hlep  command does not work as expected. ', 
+           'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['clamav.ClamavTest.test_freshclam_help'])
+    def test_freshclam_download(self):
+        status, output = self.target.run('freshclam --show-progress')
+        match = re.search('Database updated', output)
+        #match = re.search('main.cvd is up to date', output)
+        if not match:
+            msg = ('freshclam : DB dowbload failed. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 1, msg = msg)
+
+    @OETestDepends(['clamav.ClamavTest.test_freshclam_download'])
+    def test_freshclam_check_mirrors(self):
+        status, output = self.target.run('freshclam --list-mirrors')
+        match = re.search('Failures: 0', output)
+        if not match:
+            msg = ('freshclam --list-mirrors: failed. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 1, msg = msg)
+
diff --git a/meta-security/lib/oeqa/runtime/cases/samhain.py b/meta-security/lib/oeqa/runtime/cases/samhain.py
new file mode 100644
index 0000000..e4bae7b
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/samhain.py
@@ -0,0 +1,20 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class SamhainTest(OERuntimeTestCase):
+
+    @OEHasPackage(['samhain-standalone'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_samhain_standalone_help(self):
+        status, output = self.target.run('samhain --help')
+        match = re.search('Please report bugs to support@la-samhna.de.', output)
+        if not match:
+            msg = ('samhain-standalone command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 1, msg = msg)
diff --git a/meta-security/lib/oeqa/runtime/cases/sssd.py b/meta-security/lib/oeqa/runtime/cases/sssd.py
new file mode 100644
index 0000000..4644836
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/sssd.py
@@ -0,0 +1,37 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class SSSDTest(OERuntimeTestCase):
+
+    @OEHasPackage(['sssd'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_sssd_help(self):
+        status, output = self.target.run('sssctl --help')
+        msg = ('sssctl command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 1, msg = msg)
+
+    @OETestDepends(['sssd.SSSDTest.test_sssd_help'])
+    def test_sssd_sssctl_conf_perms_chk(self):
+        status, output = self.target.run('sssctl domain-status')
+        match = re.search('ConfDB initialization has failed', output)
+        if match:
+            msg = ('sssctl domain-status failed, check sssd.conf perms. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['sssd.SSSDTest.test_sssd_sssctl_conf_perms_chk'])
+    def test_sssd_sssctl_deamon(self):
+        status, output = self.target.run('sssctl domain-status')
+        match = re.search('No domains configured, fatal error!', output)
+        if match:
+            msg = ('sssctl domain-status failed, sssd.conf not setup correctly. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
+
diff --git a/meta-security/lib/oeqa/runtime/cases/suricata.py b/meta-security/lib/oeqa/runtime/cases/suricata.py
new file mode 100644
index 0000000..17fc8c5
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/suricata.py
@@ -0,0 +1,27 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class SuricataTest(OERuntimeTestCase):
+
+    @OEHasPackage(['suricata'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_suricata_help(self):
+        status, output = self.target.run('suricata --help')
+        msg = ('suricata command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 1, msg = msg)
+
+    @OETestDepends(['suricata.SuricataTest.test_suricata_help'])
+    def test_suricata_unittest(self):
+        status, output = self.target.run('suricata -u')
+        match = re.search('FAILED: 0 ', output)
+        if not match:
+            msg = ('suricata unittest had an unexpected failure. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
diff --git a/meta-security/lib/oeqa/runtime/cases/tripwire.py b/meta-security/lib/oeqa/runtime/cases/tripwire.py
new file mode 100644
index 0000000..659724d
--- /dev/null
+++ b/meta-security/lib/oeqa/runtime/cases/tripwire.py
@@ -0,0 +1,47 @@
+# Copyright (C) 2019 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class TripwireTest(OERuntimeTestCase):
+
+    @OEHasPackage(['tripwire'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_tripwire_help(self):
+        status, output = self.target.run('tripwire --help')
+        msg = ('tripwire command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 8, msg = msg)
+
+    @OETestDepends(['tripwire.TripwireTest.test_tripwire_help'])
+    def test_tripwire_twinstall(self):
+        status, output = self.target.run('/etc/tripwire/twinstall.sh')
+        match = re.search('The database was successfully generated.', output)
+        if not match:
+            msg = ('/etc/tripwire/twinstall.sh failed. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['tripwire.TripwireTest.test_tripwire_twinstall'])
+    def test_tripwire_twadmin(self):
+        status, output = self.target.run('twadmin --create-cfgfile --cfgfile /etc/tripwire/twcfg.enc --site-keyfile /etc/tripwire/site.key -Q tripwire /etc/tripwire/twcfg.txt')
+        status, output = self.target.run('twadmin --create-polfile --cfgfile /etc/tripwire/twcfg.enc --polfile /etc/tripwire/twpol.enc --site-keyfile /etc/tripwire/site.key -Q tripwire /etc/tripwire/twpol.txt')
+        match = re.search('Wrote policy file: /etc/tripwire/twpol.enc', output)
+        if not match:
+            msg = ('twadmin --create-profile ; failed. '
+               'Status and output:%s and %s' % (status, output))
+            self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['tripwire.TripwireTest.test_tripwire_twadmin'])
+    def test_tripwire_init(self):
+        status, hostname = self.target.run('hostname')
+        status, output = self.target.run('tripwire --init --cfgfile /etc/tripwire/twcfg.enc --polfile /etc/tripwire/tw.pol --site-keyfile /etc/tripwire/site.key --local-keyfile /etc/tripwire/%s-local.key -P tripwire' % hostname)
+        match = re.search('The database was successfully generated.', output)
+        if not match:
+            msg = ('tripwire --init; Failed for host: %s. '
+               'Status and output:%s and %s' % (hostname, status, output))
+            self.assertEqual(status, 0, msg = msg)