Victorian Police Chief Commissioner Graham Ashton said on Saturday the attack was terrorism. Australian Federal Police Assistant Commissioner Ian McCartney said the attacker was inspired by Islamic State.
Police said Shire Ali had his Australian passport cancelled in 2015 after an intelligence report that he planned to travel to Syria but an assessment was made that while he had radical views, he posed no threat to national security.
Home Affairs Minister Peter Dutton defended the work of security authorities which he said had 400 open investigations and needed information from the public to stop spontaneous attacks.
"The police can't contemplate every circumstance," he told reporters in Brisbane.
Dutton said encryption technology made it difficult for authorities to gather intelligence.
"That is why it is important for us to get as much information from the imams, from spouses, from family members, community members, council workers, people that might be interacting with those that might have changed their behaviours, where they think they've been radicalised," the Australian Associated Press quoted him as saying.
Imam Isse Musse, a friend of the attacker's family, for 25 said the family told him Shire Ali was mentally ill.
"They say he had a mental problem," he told Reuters.
"If someone is mentally ill they can be a prey for any propaganda, any misinterpretation ... but what can we do? The family worked hard to take him to the doctor to be diagnosed but he said no and wouldn't co-operate.
"We are very disappointed with the event...we extend our sympathy to everyone who was made a victim."
In the capital, Prime Minister Scott Morrison, Chief of Defence Force General Angus Campbell, other military personnel and diplomats attended a Remembrance Day service at the Australian War Memorial.
"As we commemorate the centenary of the Armistice and cast our minds back over the years, we know too well the deep scars of war and long to prevent them from touching an Australian soul," Morrison said in a televised speech.