- Did the gunmen act on their own or did ISIS direct them?
- There do appear to be terrorist connections, but guidance is uncertain
(CNN)Terrorists, tweets and time lines.
Authorities are looking into all three as they try to piece together this week's attack outside a Prophet Mohammed cartoon contest in the Dallas suburb of Garland, Texas.
Plenty of questions remain, but a clearer picture is forming.
ISIS has claimed responsibility for the attack, but did the gunmen, Elton Simpson and Nadir Soofi, have any direct links to the terror group or were they just acting of their own accord?
ISIS offered no proof and officials believe it's likely the group is being "opportunistic" in its claim.
A law enforcement official explained that the attack does not appear to be a clear cut case of a lone wolf inspired to act or a pure case of someone directed by others to act. Rather, the official said, it appears to be something in between.
Simpson appears to have had online ties to a British ISIS recruit -- Junaid Hussain -- thought to be in Syria and an American jihadi operating in Somalia, according to a CNN analysis of tweets exchanged ahead of Sunday's attack.
Still, it's not certain if either inspired or had a hand in the attack, a U.S. official told CNN.
One of the theories investigators are exploring is whether Simpson was just trying to gain Hussain's approval and get on his radar or whether there was actually back and forth communication between the two men."
American investigators are looking into it.
Simpson was also in touch online with American Mohamed Abdullahi Hassan, according to an analysis of social media postings by CNN.
Former FBI agent Tim Clemente concludes that the gunmen may have plotted the attack without direction from ISIS at all.
"They may not have had formal contact," Clemente said. "They may have had email communication or read communications from ISIS, but I don't think they were directed by ISIS."
"I think it's the other way around -- they were kind of applying for membership into ISIS. And so they were doing this act, sent out the tweet in advance because if they know there's a possibility they're not going to make it out of this, then they can't give recognition to what they were trying to do after the fact."
Moments before the attack, Simpson posted a tweet with the hashtag #texasattack: "May Allah accept us as mujahideen."
The tweet also said he and his fellow attacker had pledged allegiance to "Amirul Mu'mineen," which means "the leader of the faithful." CNN terrorism analyst Paul Cruickshank said that likely refers to ISIS leader Abu Bakr al-Baghdadi.
Earlier, Simpson had asked his followers on Twitter to follow an ISIS propagandist, believed to be Hussain.
After the shooting, the propagandist tweeted: "Allahu Akbar!!!! 2 of our brothers just opened fire."
Both Twitter accounts have been deactivated.
One U.S. official, who spoke on the condition of anonymity, said the shooting was "certainly more than just inspiration" by ISIS, but that assessment does not mean the terror group gave the gunmen specific instructions.
The attack fits a well-known pattern of ISIS recruitment and incitement: encouraging sympathizers via a sophisticated social media campaign to join the fight in Syria, or, if they cannot, to carry out terror attacks on their own at home, U.S. officials said Tuesday.
Timeline: Getting to Texas
Simpson and Soofi were roommates in Arizona.
Two law enforcement officials say it's believed they drove from Phoenix to Garland, but specific details about the time line of the trip or when it was made haven't been released.
The officials say investigators are trying to determine whether the gunmen had any associates in Phoenix, or elsewhere in the United States, who share the same ideology.
The FBI is scrubbing their hard drives and other electronics devices, plus interviewing friends to draw any connections.
A particular concern among law enforcement and intelligence officials is keeping track of other Americans, similar to Simpson, who are following and in touch with Hussain. One official said he's "a real problem" due to his ability to recruit online and inspire others to launch attacks in the West.
In 2011, Simpson was convicted of making a false statement involving international and domestic terrorism. Prosecutors said he told FBI agents he had not discussed traveling to Somalia to engage in "violent jihad" -- when, in fact, he had, according to an indictment.
Simpson was sentenced to three years of probation, court records show.
Soofi, on the other hand, was relatively unknown to federal investigators, a law enforcement official told CNN.
Authorities knew of no indication the pair planned to launch Sunday's attack, another law enforcement official said.
Simpson and Soofi wounded a security guard before police shot and killed them.
A separate law enforcement source said the two long guns and four handguns found in their car were bought legally.
The FBI searched the Phoenix apartment Simpson and Soofi shared and found it to be relatively barren, one of the law enforcement officials said.