The Islamic State (IS) group may be linked to bomb blasts which killed 321 people and wounded 500 in Sri Lanka, the country's prime minister has said.
Ranil Wickremesinghe said the government believed Sunday's attacks could not have been carried out without links to terror groups abroad.
The first mass funeral was held on Tuesday as Sri Lanka marked an official day of mourning for the victims.
A state of emergency remains in effect to prevent further attacks.
Police have now detained 40 suspects in connection with the attack, all of whom were Sri Lankan nationals.
"This could not have been done just locally," Mr Wickremesinghe said. "There had been training given and a coordination which we are not seeing earlier."
The Islamic State (IS) group claimed the attack on Tuesday via its Amaq news outlet. Sri Lanka's government had previously blamed the blasts on local Islamist group National Thowheed Jamath (NTJ).
Eight blasts were reported, including at three churches during Easter services.
Three hotels in the capital, Colombo - the Shangri-La, Kingsbury and Cinnamon Grand - were also targeted.
An attack on a fourth hotel on Sunday was foiled, Mr Wickremesinghe said. He did not name the hotel. He also warned that further militants and explosives could still be "out there" following the attack.
Who could be behind the attacks?
IS said it had "targeted nationals of the crusader alliance [anti-IS US-led coalition] and Christians in Sri Lanka".
It provided no evidence for the claim but shared an image on social media of eight men purported to be behind the attack.
The group's last stronghold was declared "freed" by the Kurdish-led Syrian Democratic Forces (SDF) on 23 March.
Although the declaration marked the last territorial victory over the group's caliphate, experts warn it does not mean the end of IS or its ideology.
Mr Wickremesinghe said that only Sri Lankan nationals had been arrested in connection with the attack so far, but that some of the attackers may have travelled abroad before the bombings.
''We, certainly the security apparatus, are of the view there are foreign links and some of the evidence points to that. So if the IS (Islamic State) claimed it, we will be following up on this claim," he added.
Earlier, the country's defence minister Ruwan Wijewardene told parliament that NTJ was linked to another radical Islamist group he named as JMI,.
He gave no further details.
He also said "preliminary investigations" indicated that the bombings were in retaliation for deadly attacks on mosques in Christchurch, New Zealand, in March, but again gave no further information.
NTJ has no history of large-scale attacks but came to prominence last year when it was blamed for damaging Buddhist statues. The group has not said it carried out Sunday's bombings.
Sunday's attacks have highlighted rifts in Sri Lanka's leadership, after it emerged that authorities were warned about an imminent threat from the NTJ jihadist group.
But Prime Minister Ranil Wickremesinghe and the cabinet were not informed, ministers said
The Sri Lankan government has said locals from two known groups carried out the attack. But from the start - because of the scale and sophistication of it - they have also said they thought there was an external role.
In the past, IS has sometimes claimed attacks that it was not involved in or which it simply inspired. But the details from so-called Islamic State would seem to back up the government's assessment.
The choice of targets is much more in line with IS ideology than with the traditional types of communal violence seen in Sri Lanka.
There are still questions - did the local men affiliate themselves to IS or receive direct support? Did they travel to Syria or to other countries? The Sri Lankan government has said it believes some of them had spent time abroad, but how significant was that to the plot?
Answering questions like these will be important not just for Sri Lanka but other countries as they try and understand whether other relatively small, locally focused groups could be capable of transforming a threat into violence on such a massive scale.
Who were the victims?
Most of those who died were Sri Lankan nationals, including scores of Christians attending Easter Sunday church services.
One of the first victims to be publicly identified was Sri Lankan celebrity chef Shantha Mayadunne and her daughter Nisanga Mayadunne, who had posted a picture of the family having breakfast in the Shangri-La Hotel in Colombo shortly before the deadly blast.
Sri Lankan officials said 38 foreign nationals were among the dead, with another 14 unaccounted for. The death toll includes at least eight British citizens and at least 10 Indian nationals.
Three of Danish billionaire Anders Holch Povlsen's children were killed in the attack, a family spokesman confirmed to the BBC. Mr Povlsen owns the Bestseller clothing chain and holds a majority stake in clothing giant Asos.
The mass funeral for about 30 victims took place at St Sebastian's church in Negombo, north of Colombo, which was one of the places targeted in Sunday's blasts. Another funeral service was scheduled for later on Tuesday.
A moment of silence was also observed at 08:30 on Tuesday, reflecting the time the first of six bombs detonated. Flags were lowered to half-mast and people, many of them in tears, bowed their heads in respect.