Symptom
High unmanaged disk usage on /ngfw alerts are seen on FMC GUI due to an accessive URL file storage in the FTD sensors
Workaround
create an empty "SFDataCorrelator.run" file under /etc/sf by doing:
cd /etc/sf
touch SFDataCorrelator.run
Restart SFDataCorrelator by running "pmtool restartbyid SFDatacorrelator"
Check the SFData ststus by "pmtool status | grep SFDataCorrelator" (it should be in running status)