Five people are in custody following the al-Shabab attack in eastern Kenya on Thursday which left almost 150 people dead, officials say.
Some of the suspects were arrested while trying to flee to neighbouring Somalia, the internal security ministry said.
At least 148 people – mostly students – were killed when gunmen attacked a university campus in Garissa.
Al-Shabab has since pledged a “long, gruesome war” against Kenya.
The militant group said its attacks were in retaliation for acts by Kenya’s security forces, who are part of the African Union’s mission in Somalia against al-Shabab.
In Garissa, a survivor has emerged from hiding more than two days after the assault was unleashed.
The 19-year-old girl was found unhurt in a cupboard on Saturday, but security officials had to bring in a teacher to convince her that it was safe to come out, the BBC’s Andrew Harding reports.
She told reporters that she drank body lotion when she felt hungry.
Four other people were found alive on the campus on Friday, including two suspects. One was said to be a Tanzanian national with no known links to the university.
While many of the survivors spoke to the media, little is known so far about those who were killed.
Their bodies have been flown to Nairobi for identification, as local mortuaries have been unable to cope, and many of the students killed came from other parts of the country.
There has been criticism in Garissa, which is 150km (100 miles) from the Somali border, at how the security services dealt with the attack.
Emmanuel Igunza, BBC World Service, Nairobi
At the Nairobi mortuary where bodies of the dead students were taken, a woman I met had travelled from eastern Kenya, frustrated by the lack of news about her son. She had last spoken to him just as gunmen stormed the university. His phone then went dead.
“I can only hope that just maybe he is alive and hiding somewhere. But as a mother, I can feel and tell he won’t come back to me alive,” she said.
Anxious parents and relatives were privately being shown pictures of the victims. Some broke down after the fate of their loved ones became clear.
A Red Cross official told me the process was slow, as they first had to reconstruct bodies because of severe and, in some cases, multiple gunshot wounds. Others had been beheaded.
Only two guards were on duty at the time of the assault, despite official warnings that an attack on an institution of higher learning was likely.
One survivor said the students had raised security issues late last year. Another said the gunmen appeared to know the site well.
Another witness told the BBC she heard the gunman receiving instructions on mobile phones, and speaking in Swahili, an official language in Kenya – raising the possibility the attackers were locals and not from Somalia, al-Shabab’s heartland.
In an address to the nation after the attack, President Uhuru Kenyatta said he had instructed the police chief to speed up the training of 10,000 recruits, because Kenya had “suffered unnecessarily” because of a shortage of security personnel.
Police in neighbouring Uganda say they have received information suggesting a similar attack is being planned there.
Garissa university campus
1. Militants enter the university grounds, two guards are shot dead
2. Shooting begins within the campus
3. Students attacked in their classrooms while preparing for exams
4. Gunmen believed isolated in the female dormitories
5. Some students make an escape through the fence
Are you in the Kenyan town of Garissa? Did you witness the attack in the town’s university? Are you affected by the attack? You can share your experiences by emailing.
If you would be happy to speak further to a BBC journalist, please include a contact telephone number.
Or WhatsApp us on +44 7525 900971
Read our terms and conditions.