Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people - mostly students - were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a "long, gruesome war" against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya's security forces, who are part of the African Union's mission in Somalia against al-Shabab.
Al-Shabab was also blamed for the Westgate Mall attack in the capital Nairobi in 2013, in which 67 people died.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
Security questions
In Garissa, four more people were found alive on the campus on Friday, but two are suspects and have been arrested, sources say. One is said to be a Tanzanian national with no known links to the university.
Kenyan newspapers earlier said security services seem to have had information that an attack on an institution of higher learning was likely, and appear to have warned such establishments to be careful.
Two guards were on duty at the time of the attack. Locals in Garissa, 150km (100 miles) from the Somali border, questioned why security was not boosted in light of the intelligence.
Many of the students who survived were escorted off the campus to receive counselling
Kenyan forces prepared to sweep inside the campus hours after the attack
Long queues formed at mortuaries to identify the victims
"It's because of laxity by the government that these things are happening. For something like this to happen when there are those rumours is unacceptable," said Mohamed Salat, 47, a Somali Kenyan businessman.
One survivor, who hid in bushes during the assault, said the students had raised security issues late last year, but only two armed guards had been provided. Another said the gunmen appeared to know the site well.
Another witness told the BBC she heard the gunman receiving instructions on mobile phones, and speaking in Swahili, an official language in Kenya - raising the possibility the attackers were locals and not from Somalia, al-Shabab's heartland.
In an address to the nation after the attack, President Uhuru Kenyatta said he had instructed the police chief to speed up the training of 10,000 recruits, because Kenya had "suffered unnecessarily" because of a shortage of security personnel.
The bodies of those killed in Garissa have been flown to Nairobi for identification, as local mortuaries have been unable to cope, and many of the students killed came from other parts of the country.
The masked attackers killed two security guards at dawn on Thursday, then rampaged through campus, shooting and shouting "we are al-Shabab".
They singled out Christians and shot them, witnesses said.
While many of the survivors spoke to the media, little is known so far about those who were killed.
The BBC's Frenny Jowi says Kenyan media have been cautious in their coverage because of a new anti-terror law that stipulates heavy fines for material "likely to cause fear".
Latest Stories
-
68% of soils in Amansie East, Bosomtwe, Bosome Freho acidic due to excessive fertilizer application
4 mins -
Ato Forson alleges attempts by government to induce 800k voters with hand-outs
17 mins -
2025 AFCONQ: Is Ghana’s four-game winless run a sign of their new reality?
1 hour -
Over 1,000 pupils stranded as contractor locks up school in Ga South over non-payment for project
1 hour -
IET-GH cautions against use of bamboo as concrete reinforcement
2 hours -
Sporting Club Accra crowned champions of 2024 SBE Cup
2 hours -
Speaker defers ruling on petition to oust 4 MPs
2 hours -
Full nominees list: 2024 Guinness Ghana DJ Awards
2 hours -
Akufo-Addo: I was willing to take the political risk to fight galamsey
2 hours -
Stop contradicting yourself; tell Ghanaians your position on galamsey fight – Akufo-Addo to Mahama
2 hours -
Calling off strike at this stage would be premature and counterproductive – UTAG
2 hours -
Playback: MPs debated attempt to oust 4 members
3 hours -
Anlo Literary Project on a mission to enhance literacy among children
3 hours -
Afenyo-Markin cautions Minority Leader against politicising galamsey fight
3 hours -
Theory-based knowledge giving way to practical, hands-on solutions – Dep. Education Minister in charge of TVET
3 hours