Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people - mostly students - were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a "long, gruesome war" against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya's security forces, who are part of the African Union's mission in Somalia against al-Shabab.
Security questions
In Garissa, a survivor has emerged from hiding more than two days after the assault was unleashed.
The 19-year-old girl was found unhurt in a cupboard on Saturday, but security officials had to bring in a teacher to convince her that it was safe to come out, the BBC's Andrew Harding reports.
She told reporters that she drank body lotion when she felt hungry.
Four other people were found alive on the campus on Friday, including two suspects. One was said to be a Tanzanian national with no known links to the university.
While many of the survivors spoke to the media, little is known so far about those who were killed.
Their bodies have been flown to Nairobi for identification, as local mortuaries have been unable to cope, and many of the students killed came from other parts of the country.
There has been criticism in Garissa, which is 150km (100 miles) from the Somali border, at how the security services dealt with the attack.
Only two guards were on duty at the time of the assault, despite official warnings that an attack on an institution of higher learning was likely.
One survivor said the students had raised security issues late last year. Another said the gunmen appeared to know the site well.
Another witness told the BBC she heard the gunman receiving instructions on mobile phones, and speaking in Swahili, an official language in Kenya - raising the possibility the attackers were locals and not from Somalia, al-Shabab's heartland.
In an address to the nation after the attack, President Uhuru Kenyatta said he had instructed the police chief to speed up the training of 10,000 recruits, because Kenya had "suffered unnecessarily" because of a shortage of security personnel.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
(BBC)