Two Kenyan soldiers who had been inside the mall shortly before the president spoke said the operation was mostly over, but security forces were still combing the facility and had not definitively cleared all the rooms.
Another higher-ranking security official involved in the investigations said it would take time to search the whole mall before declaring that the terrorist threat had been crushed.
Al-Shabab, whose name means "The Youth" in Arabic, first began threatening Kenya with a major terror attack in late 2011, after Kenya sent troops into Somalia following a spate of kidnappings of Westerners inside Kenya.
The group used Twitter throughout the four-day siege to say that Somalis have been suffering at the hands of Kenyan military operations in Kenya, and the mall attack was revenge.
"You could have avoided all this and lived your lives with relative safety," the group Tweeted Tuesday. "Remove your forces from our country and peace will come."