The officer, who asked not to be named, also told Reuters police were pursuing a woman suspected of ferrying weapons to Nairobi from Kiunga, near the border with neighboring Somalia, via the port city of Mombasa.
President Uhuru Kenyatta said on Wednesday that a 20-hour siege had ended with security forces killing five militants who had stormed the hotel complex, forcing hundreds of people into terrifying escapes.
Five suspects, one of them listed as a Canadian citizen, were taken to a magistrates court on Friday and ordered detained for 30 days to complete investigations that were "complex and transnational," court documents said.
The fate of the other four suspects who the police officer said were being held was not immediately clear. Police can hold suspects for 24 hours and need a court order to extend this.
Al Shabaab, a Somalia-based al Qaeda affiliate fighting to impose strict Islamic law, said it carried out the assault on the upscale dusitD2 compound over U.S. President Donald Trump's decision to recognize Jerusalem as Israel's capital.