Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people – mostly students – were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a “long, gruesome war” against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya’s security forces, who are part of the African Union’s mission in Somalia against al-Shabab.
Al-Shabab was also blamed for the Westgate Mall attack in the capital Nairobi in 2013, in which 67 people died.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
In Garissa, four more people were found alive on the campus on Friday, but two are suspects and have been arrested, sources say. One is said to be a Tanzanian national with no known links to the university.
Kenyan newspapers earlier said security services seem to have had information that an attack on an institution of higher learning was likely, and appear to have warned such establishments to be careful.
Two guards were on duty at the time of the attack.
Locals in Garissa, 150km (100 miles) from the Somali border, questioned why security was not boosted in light of the intelligence.
“It’s because of laxity by the government that these things are happening.
For something like this to happen when there are those rumours is unacceptable,” said Mohamed Salat, 47, a Somali Kenyan businessman.
One survivor, who hid in bushes during the assault, said the students had raised security issues late last year, but only two armed guards had been provided.
Another said the gunmen appeared to know the site well.