The man held on suspicion of killing three people at a park in Reading was known to MI5, security sources say.
Khairi Saadallah, 25, from the town, was arrested on Saturday and police say they are not looking for anyone else over the terror incident.
Sources told the BBC he is originally from Libya and came to the attention of MI5 in 2019.
One victim has been named as teacher James Furlong - described by his family as "a wonderful man".
Paying tribute to Mr Furlong, 36, head of history, government and politics at The Holt School in Wokingham, his parents Gary and Janet said: "He was beautiful, intelligent, honest and fun."
PM Boris Johnson said he was "appalled and sickened" by the attack in Forbury Gardens on Saturday evening.
Counter Terrorism Policing South East (CTSPE) said a 25-year-old man from Reading, who was arrested initially on suspicion of murder on Saturday, has now been re-arrested under Section 41 of the Terrorism Act 2000.
Security sources said the suspect came to the attention of the security services after they received information he had aspirations to travel abroad - potentially for terrorism, according to the BBC's home affairs correspondent Dominic Casciani.
When the information was further investigated, as the first stage of looking into a potential lead, no genuine threat or immediate risk was identified.
No case file was opened which would have made him a target for further investigation.
The Holt School said Mr Furlong was a "kind and gentle man" with a "real sense of duty".
In a statement, Anne Kennedy and Katie Pearce - co-head teachers of the secondary school for girls - said Mr Furlong "truly inspired everyone he taught through his passion for his subject and his dedication".
"He was determined that our students would develop a critical awareness of global issues and in doing so, become active citizens and have a voice," they said.
Mr Johnson has promised action following the incident "if there are lessons that we need to learn".
Metropolitan Police Assistant Commissioner Neil Basu, head of counter-terrorism policing, described it as an "atrocity" and said his "deepest sympathies go to the families who will be mourning loved ones after this horrific act".
Mr Basu said investigators are not looking for anyone else in connection with the attack.
Saturday's horrifying killings may be another example of what security chiefs call a "lone actor" attack where a single individual turns extremist beliefs into murderous actions.
In November last year, the UK's official threat level from terrorism was reduced from "severe" to "substantial" - meaning it remained likely - but there was no intelligence of an immediate risk to life.
Since then, there have already been three major incidents in which two people have died. Two of those attacks were carried out by lone individuals.
Today, detectives will be interviewing their suspect - and a huge operation will have swung into operation.
Electronic analysts will delve into any social media accounts linked to the suspect; they'll trawl every call and text message going back years, looking for contacts with extremists.
Intelligence officers at MI5 will review both their open and closed case files on so-called "subjects of interest".
A picture will emerge of the suspect's movements. What led to the attack may be very difficult to identify.
Detective Chief Superintendent Kath Barnes, Head of CTPSE, said the investigation "continues to move at a fast pace".
The suspect was arrested within five minutes of the first emergency call made to police, and a number of officers were quickly on the scene, she confirmed.
A friend of the suspect told the BBC's home affairs correspondent Daniel Sandford that Saadallah seemed to be a "normal, genuine guy", and had been someone with whom to smoke cannabis.
Kieran Vernon said: "He seemed like me or you. Whenever we used to meet up we used to talk about drinking whisky and how different ganja affects the different thinking of mind.
"And that's pretty much all we'd chat about."
Mr Sandford was also told by neighbours of the suspect that he once threw a television out of a top floor window and was regularly visited by a mental health key worker.
A witness told the BBC he saw a man moving between groups of people in the park in Reading town centre, trying to stab them.
Three other people were injured in the attack, which took place at about 19:00 BST on Saturday.
Two of the injured people have been discharged and one remains in hospital, although the injuries are not thought to be life-threatening.
Labour leader Sir Keir Starmer has said that "people are united in their grief" following the attack, and that he wants to speak to the prime minister to discuss how to "learn from this."
"This is not a time for party politics," he said.
"It's incumbent on all of us to pull together in response to this on a cross party basis."
Thames Valley Police said on Sunday morning the attack was now being treated as terrorism and that Counter Terrorism Policing South East would be taking over the investigation.
Speaking to reporters later, the force's chief constable, John Campbell, said lives had been "devastated", but added that there was not believed to be a wider risk to the public and there was nothing to suggest anyone else was involved.
He added: "I am sure we would all want to recognise the bravery of those police officers responding, but also that a number of members of the public were helping my officers and the victims at what was a very distressing scene."
The prime minister has held a meeting with security officials, police and senior ministers over the incident.
Speaking in Downing Street, Mr Johnson said: "If there are lessons that we need to learn about how we handle such cases, how we handle the events leading up to such cases then we will learn those lessons and we will not hesitate to take action when necessary."
He said that included changes to the law, as they had done over the automatic early release of terrorist offenders.
Media playback is unsupported on your device
Of the three injured people, one was seen at the John Radcliffe Hospital in Oxford, where they were discharged without being admitted to hospital.
Two were admitted to the Royal Berkshire Hospital in Reading. One has been discharged, while another remains in a stable condition under observation.
Mr Basu said police were working with the coroner to formally identify those who had died and he praised the actions of Thames Valley Police officers - "unarmed and incredibly brave" - who detained the suspect.
He also said the public should not be alarmed about visiting busy places as a result of this attack.
A police cordon remains in place around Forbury Gardens - which is a short walk from the train station - and blue and white tents have been erected next to the walls of the park.
The UK's terrorism threat level of "substantial" is the third of five ratings at which the threat level can stand.
https://www.bbc.com/news/uk-53129046
from potads - All Forums learn more
