Far-right extremists were on the intelligence radar and tip-offs about their activity had been followed up ahead of the Christchurch mosque attack, according to the Government and intelligence bosses.
The minister responsible for intelligence agencies, Andrew Little, said the SIS commissioned its own internal review into the far right about nine months ago.
It was in response to the "obvious rise" of white supremacism, and other far right activity around the world,he said.
"The rise of white supremacism had become apparent in the arrests in Europe and other parts of the word and it was at that point the SIS undertook its programme of work to consider how they had to gear up to deal with that issue."
The Government has announced a review into the Christchurch mosques massacre which killed 50 people and injured another 50.
Little said it could be followed by Royal Commission of inquiry.
Australian Brenton Tarrant has been charged with murder.
The hunt for answers to the mosque attack, and any international links, has become a global effort, with agencies from the US, Australia, the UK and others now involved.
The focus of the review will be what the intelligence agencies, police and customs knew, and whether they could have done more to anticipate the attack.
Three weeks before the deadly attack, SIS boss Rebecca Kitteridge told a parliamentary committee the threat of terrorist attack in New Zealand was low, meaning an attack was assessed as possible but not expected.
She also outlined the focus of her agency and the number of people on its "watch list", which has fluctuated between 30 and 40 for a number of years.
Her briefing to MPs focused mostly on the threat from people being radicalised online by Islamic State ideology and the threat posed by a "small but concerning number of New Zealanders" who engaged with this often violent online content and the risk they presented to others.
She referenced far-right extremism, but largely in the context of its "slow but concerning rise" internationally.
Tarrant appeared to be a member of right wing chat groups but none of his activities brought him to the attention of police or the intelligence agencies in Australia or New Zealand.
The Australian government says Tarrant spent most of the past three years overseas which is why its agencies missed him, according to news.com.au.
Australian Home Affairs Minister Peter Dutton said Tarrant had spent just 45 days in Australia over the past three years, and had been travelling internationally extensively for the past nine years.
Tarrant moved to New Zealand in 2017.
Little told TVNZ's Corin Dann on Monday evening he did not believe the intelligence agencies had failed but the inquiry would assess "what they should have known, what they could have known".
Little did not accept there had been too much focus on Islamic extremism.
Asked if they had also followed up on tip-offs about far-right extremism, Little responded: "As the Minister I sign every warrant that those agencies operate under that are the most intrusive activities that they do.
"No warrant lasts more than 12 months. So every warrant that is actively being pursued at the moment is one that I've signed off. What I can say without divulging too much and compromising their ability to do their job is that a proportion of those jobs relate to extremism ... they relate to all forms of extremism."
Tarrant live streamed video of his attack to several sites and his Facebook page. He also tweeted pictures of his weapons. The posts have how been taken down and his accounts shut down, however, so the extent to which he foreshadowed the attack is not clear.
He emailed a number of international media organisations, and Stuff, and a number of Government addresses including the Prime Minister's office with a manifesto explaining the attacks, but only minutes before he started shooting.
He was reportedly a member of extreme right wing chat groups online.
Little said Tarrant operated on his own and it was not clear he had a visible presence on social media in terms of some of the threats that had been alleged since his alleged killing spree.
But part of the inquiry would be looking more closely at whether anything was missed.
He said security agencies were working around the clock and there was a heightened sensitivity to threats, including a surge of online activity.
"There is a lot of action and activity. There are people who have been online, making statements who have been interviewed by police. That will continue. So there is a level of intervention, a heightened level of monitoring," he told Q+A.
In a rare step on Monday evening, GCSB director Andrew Hampton confirmed the agency had not collected or received any relevant intelligence from its partner agencies ahead of the terrorist attacks.
The GCSB is part of the international Five Eyes surveillance network which also includes the US, Australia, Canada, Britain.
Sensitivities around the scope of Five Eyes mean there are strict rules around GCSB surveillance of New Zealanders.
Hampton said New Zealand's intelligence and security agencies do not currently have "the legal authority, technical means or resources to actively monitor all online activity that occurs in New Zealand".
"In addition, all intelligence and security agencies are grappling with the challenges of encryption and closed online communities.
"GSCB has stood up a 24-hour operation response team which is working with domestic agencies and foreign partners to support police and NZSIS.
"It is important that there will be the inquiry and GCSB is committed to providing all necessary support. It is of the utmost importance that the public are assured that GCSB acted lawfully and appropriately."
Kitteridge said she was limited in what she could say about individuals "and that's especially the case while there is an active police investigation".
"The person charged with murder has not ever been brought to the attention of NZSIS and is not known to NZSIS or our Australian counterpart.
"Over the last nine months, NZSIS has increased its effort to obtain a better picture of the threat posed to New Zealand by far-right extremist groups. The NZSIS has over recent years received a number of tips from the public concerning far-right extremism and has taken each one seriously.
"There are important questions which need answers. We embrace the opportunity to learn from this terrible experience. Our work must often be carried out in secret, but I am a big believer in transparency where possible.
"NZSIS has two top priorities right now. We are focused on supporting police in their important investigation and the resulting prosecutions. We are also focused on mitigating the risks to New Zealanders posed by possible revenge or copycat attacks.
"To achieve this mission the NZSIS is currently operating 24 hours a day and is drawing on all our international partnerships.
"I would like to acknowledge the incredible support we are receiving from our international partners – I cannot go into detail, but I would like New Zealand to know that this is a global response."