Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people - mostly students - were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a "long, gruesome war" against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya's security forces, who are part of the African Union's mission in Somalia against al-Shabab.
Al-Shabab was also blamed for the Westgate Mall attack in the capital Nairobi in 2013, in which 67 people died.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
In Garissa, four more people were found alive on the campus on Friday, but two are suspects and have been arrested, sources say. One is said to be a Tanzanian national with no known links to the university.
Kenyan newspapers earlier said security services seem to have had information that an attack on an institution of higher learning was likely, and appear to have warned such establishments to be careful.
Two guards were on duty at the time of the attack. Locals in Garissa, 150km (100 miles) from the Somali border, questioned why security was not boosted in light of the intelligence.
"It's because of laxity by the government that these things are happening. For something like this to happen when there are those rumours is unacceptable," said Mohamed Salat, 47, a Somali Kenyan businessman.
One survivor, who hid in bushes during the assault, said the students had raised security issues late last year, but only two armed guards had been provided. Another said the gunmen appeared to know the site well.
Another witness told the BBC she heard the gunman receiving instructions on mobile phones, and speaking in Swahili, an official language in Kenya - raising the possibility the attackers were locals and not from Somalia, al-Shabab's heartland.
In an address to the nation after the attack, President Uhuru Kenyatta said he had instructed the police chief to speed up the training of 10,000 recruits, because Kenya had "suffered unnecessarily" because of a shortage of security personnel.
The bodies of those killed in Garissa have been flown to Nairobi for identification, as local mortuaries have been unable to cope, and many of the students killed came from other parts of the country.
The masked attackers killed two security guards at dawn on Thursday, then rampaged through campus, shooting and shouting "we are al-Shabab".
They singled out Christians and shot them, witnesses said.
While many of the survivors spoke to the media, little is known so far about those who were killed.
The BBC's Frenny Jowi says Kenyan media have been cautious in their coverage because of a new anti-terror law that stipulates heavy fines for material "likely to cause fear".