Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people - mostly students - were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a "long, gruesome war" against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya's security forces, who are part of the African Union's mission in Somalia against al-Shabab.
Al-Shabab was also blamed for the Westgate Mall attack in the capital Nairobi in 2013, in which 67 people died.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
Security questions
In Garissa, four more people were found alive on the campus on Friday, but two are suspects and have been arrested, sources say. One is said to be a Tanzanian national with no known links to the university.
Kenyan newspapers earlier said security services seem to have had information that an attack on an institution of higher learning was likely, and appear to have warned such establishments to be careful.
Two guards were on duty at the time of the attack. Locals in Garissa, 150km (100 miles) from the Somali border, questioned why security was not boosted in light of the intelligence.
Many of the students who survived were escorted off the campus to receive counselling
Kenyan forces prepared to sweep inside the campus hours after the attack
Long queues formed at mortuaries to identify the victims
"It's because of laxity by the government that these things are happening. For something like this to happen when there are those rumours is unacceptable," said Mohamed Salat, 47, a Somali Kenyan businessman.
One survivor, who hid in bushes during the assault, said the students had raised security issues late last year, but only two armed guards had been provided. Another said the gunmen appeared to know the site well.
Another witness told the BBC she heard the gunman receiving instructions on mobile phones, and speaking in Swahili, an official language in Kenya - raising the possibility the attackers were locals and not from Somalia, al-Shabab's heartland.
In an address to the nation after the attack, President Uhuru Kenyatta said he had instructed the police chief to speed up the training of 10,000 recruits, because Kenya had "suffered unnecessarily" because of a shortage of security personnel.
The bodies of those killed in Garissa have been flown to Nairobi for identification, as local mortuaries have been unable to cope, and many of the students killed came from other parts of the country.
The masked attackers killed two security guards at dawn on Thursday, then rampaged through campus, shooting and shouting "we are al-Shabab".
They singled out Christians and shot them, witnesses said.
While many of the survivors spoke to the media, little is known so far about those who were killed.
The BBC's Frenny Jowi says Kenyan media have been cautious in their coverage because of a new anti-terror law that stipulates heavy fines for material "likely to cause fear".
Latest Stories
-
Atletico Madrid beat Barcelona to go top of La Liga
3 minutes -
Usyk breaks Fury’s heart with points win in rematch
5 minutes -
Ghana-Russia Centre to run Russian language courses in Ghana
6 hours -
The Hidden Costs of Hunger: How food insecurity undermines mental and physical health in the U.S.
6 hours -
18plus4NDC marks 3rd anniversary with victory celebration in Accra
9 hours -
CREMA workshop highlights collaborative efforts to sustain Akata Lagoon
9 hours -
2024/25 Ghana League: Heart of Lions remain top with win over Basake Holy Stars
10 hours -
Black Queens: Nora Hauptle shares cryptic WAFCON preparation message amid future uncertainty
10 hours -
Re-declaration of parliamentary results affront to our democracy – Joyce Bawah
11 hours -
GPL 2024/25: Vision FC score late to deny Young Apostles third home win
11 hours -
Enhancing community initiatives for coastal resilience: Insights from Keta Lagoon Complex Ramsar Site Workshop
11 hours -
Family Health University College earns a Presidential Charter
11 hours -
GPL 2024/25: Bibiani GoldStars beat Nsoatreman to keep title race alive
11 hours -
GPL 2024/25 Bechem United keep title hopes alive with narrow win over FC Samartex
11 hours -
2024/25: Dauda Saaka scores as Asante Kotoko beat Dreams FC
11 hours