The identity of the Bourke Street attacker has been confirmed as Hassan Khalif Shire Ali.
Police allege the 30-year old Somalian-born man had been planning to use gas cylinders to cause an explosion in Melbourne.
One person was fatally stabbed and two others injured in Friday's attack in the heart of Melbourne.
Mr Shire Ali set a car alight then stabbed three men before he was shot by police in the chest.
He later died in hospital.
Federal and Victoria security agencies have mounted a terrorism investigation as IS claimed responsibility for the attack - for which they provided no evidence.
But despite authorities saying he was a person of interest, Victoria's Chief Commissioner Graham Ashton has admitted to the Nine Network the attack came as a surprise.
"Look, he is someone that was known to us but the information that we had through the night, we with working on, he wasn't somebody that we were actively monitoring to that we were actively monitoring to that level in relation to his activities, no."
AFP Assistant Commissioner Ian McCartney said intelligence gathering is still proving the most complex challenge for his agency.
"The event yesterday for us is a reality check even with the fall of the caliphate in the conflict zone. The threat continues to be real," he told reporters in Melbourne.
He said Mr Shire Ali had been known to authorities but had not been considered a threat at the time.
"In terms of how and why, and when he moved along that path to radicalisation to basically putting in place those actions, that'll be a key focus of this investigation and I dare say other investigations."
Prime Minister Scott Morrison and the Opposition leader Bill Shorten have both condemned the attack.
Attacker had plans to cause explosion
Chief Commissioner Graham Ashton said Shire Ali's car contained gas cylinders and it is believed he intended to cause an explosion.
A burnt out vehicle is seen on Bourke Street in Melbourne. Source: AAP
"There were gas cylinders in the car which had been turned to the open position. It certainly wasn't remotely sophisticated, evidenced by the fact that the car just caught fire."
Police are confident the event was a terrorist attack.
"So, clearly, a terrorism act, the motivation is to cause terror and cause maximum casualties regardless of their own safety and well-being of the perpetrator."
Police defend chest shot
When asked if police should have shot Shire Ali in the leg rather than the chest, Commissioner Ashton said police were trained to kill if they believed their life or a member of the public's life was at risk.
"Once a member (of the police unit) is of the view that the firearm is the last resort, that's when they're drawn. When a firearm is the last resort, they're (police are) trained to shoot to kill, shoot to the body mass."
He says police have worked through the night and don't believe there are any ongoing threats to the public.
The incident at Bourke Street Mall. Source: Twitter
Police reject suggestion Ali was inspired by 2017 Bourke St attacker
Commissioner Ashton also says there is no suggestion that Shire Ali was inspired by James "Dimitrious" Gargasoulas, who is currently on trial facing six charges of murder after allegedly mowing down pedestrians in January 2017.
"This is something that we're looking for but there's been nothing obtained so far, showing that there's any ideological link between that ongoing trial and the publicity around that, and this event," he said.
The Islamic State group has claimed responsibility for the attack.
Commissioner Ashton says Shire Ali had a criminal history for cannabis use, theft and driving offences.
The bomb squad was called after the barbecue-style gas cylinders were found in the vehicle.
Police say the name of the deceased victim will be released later in the afternoon after discussions with family. They say he was a 74-year-old worker in the CBD.
A 26-year-old man and a 58-year-old, said to be Tasmanian businessman Rod Patterson, were taken to hospital with what police said were non-life threatening injuries following the attack.
Police confirmed Shire Ali's name and age on Saturday morning after incorrect information was circulated through media reports.
