Kallas added that Monday's discussion will look at how EU institutions can work with member countries to determine which tools in the EU's arsenal could be used as part of the protocol response.

While diplomats say the details are still vague on what the protocol could entail in theory, it could apply to drone incursions, sabotage and cyberattacks, once it's clear who was responsible. Kallas stressed that the protocol would apply to "everything that is under the threshold of armed aggression."

Von der Leyen's proposal had raised fears among EU countries over a turf war with NATO. Speaking to reporters at the end of the ministers' meeting Monday, Kallas said it is still unclear whether there’s a majority of member countries in favor of it.

Over the summer, hybrid activity linked to Russia increased dramatically. Drone overflights, crashes and explosions have become almost daily occurrences in some parts of Eastern Europe, particularly in countries bordering Ukraine. There is also growing speculation that the Kremlin could expand its campaign to Western Europe. Tensions between Germany and Russia reached a peak this month after Berlin accused Russia of being behind a drone attack at Leipzig airport earlier this year.

Russia is "not gaining any success on the battlefield. So that's why they are increasing pressure and hybrid actions towards [countries] supporting countries for Ukraine," Finnish Defense Minister Antti Häkkänen told reporters at the doorsteps of the ministers' meeting. That's why "we have to approach this problem [with] calm but decisively."

Häkkänen said the emergency protocol responses could include further sanctions and restrictions on visas for Russian tourists. But "we need close cooperation with NATO," he added.