Three teams carried out the attacks in the French capital which killed 129 people and left more than 350 wounded, the Paris chief prosecutor says.
“We have to find out where they came from… and how they were financed,” Francois Molins told reporters.
He said seven attackers had been killed, and that all had been heavily armed and wearing explosive belts.
Friday’s attacks, claimed by Islamic State militants, hit a concert hall, a major stadium, restaurants and bars.
Mr Molins also said the arrests of three men in Belgium on Saturday were linked to the attacks.
Belgian Prime Minister Charles Michel said investigators were trying to establish whether one of the suspects picked up near Brussels might have been in Paris on Friday evening.
Speaking in Paris on Saturday evening, Mr Molins told reporters: “We can say at this stage of the investigation there were probably three co-ordinated teams of terrorists behind this barbaric act.”
He also confirmed that one of the dead attackers had been identified as a 30-year-old Frenchman who had a criminal record but had never spent time in jail.
The man came from the town of Courcouronnes, 25km (15 miles) west of Paris. He had been identified by the security services as having been radicalised but had never been implicated in a counter-terrorism investigation.
Mr Molins said all seven militants had used Kalashnikov assault rifles and the same type of explosive vests.
In the latest development, French police have taken the father and brother of one of the attackers into custody, judicial sources told AFP news agency.
On Saturday evening, a tourist thought he saw something suspicious at the Pullman hotel near the Eiffel Tower and sparked a security alert. But a police search found nothing and the operation was called off.
Mr Molins also gave details about the state of the investigation, which he said was at a very early stage.
He said police were focusing on two vehicles. One was a black Seat used by gunmen at two of the attacks and still untraced.
The other is a black Volkswagen Polo with Belgian registration plates found at the concert venue that was targeted.
He said this had been rented by a Frenchman living in Belgium.
He was identified while driving another vehicle in a spot check by police on Saturday morning as he crossed into Belgium with two passengers.
The BBC’s Hugh Schofield in Paris says investigators are working on the theory that these three may be another team of attackers who managed to flee the scene.
The Greek authorities say two people under investigation by the French police had registered in Greece as Syrian refugees.
A Syrian passport was found near the body of one the attackers at the Stade de France.
An Egyptian passport has also been linked to the attacks.
French President Francois Hollande imposed a state of emergency after the worst peacetime attack in France since World War Two. It is also the deadliest in Europe since the 2004 Madrid bombings.
The violence began soon after 21:00 (20:00 GMT) as people were enjoying a Friday night out in the French capital.
A gunman opened fire on Le Carillon bar near the Place de la Republique in the 10th arrondissement (district) , before heading across the road to Le Petit Cambodge (Little Cambodia), killing a total of 15 people.
“We heard the sound of guns, 30-second bursts. It was endless,” resident Pierre Montfort said.
A few streets away, diners sitting on the terrace of La Casa Nostra pizzeria were also fired on, with the loss of five lives.
Mr Molins said 19 people had been killed at the Belle Equipe bar in the 11th arrondissement, while the toll from the attack on the Bataclan concert hall stood at 89.
At about the same time, on the northern outskirts of Paris, 80,000 people who had gathered to watch France play Germany at the Stade de France heard three explosions outside the stadium.
President Hollande was among the spectators and was whisked away after the first blast.
Investigators had found the bodies of three suicide bombers around the Stade de France, Mr Molins said.